Merge remote-tracking branch 'origin/develop' into feature/ui-api-endpoints

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -8,6 +8,22 @@ All notable changes are documented here, following [Keep a Changelog](https://ke
 
 ### Added
 
+- Collaboration UI API extension `1.0.0`: 42 typed operations for favorites, recents, attachments, tags, comments, mentions, follow, timeline, people, sharing, access requests, tasks, assignment and My work under `/qqq/v1/qbit/collaboration`, enabled by default and disabled with `withUiApi(false)`.
+- Real multipart uploads; download/preview return five-minute `{url}` responses (clients follow url) because the framework cannot describe a redirect Location header. Configurable attachment storage adapter supports in-memory HTTP tests.
+- Versioned `ToSchema` wire types, enum values, semantic parameter descriptions, generated OpenAPI fragment and drift check; real HTTP tests cover all operations, paging, parent visibility, permissions, validation and storage failures.
+- Shared HTTP page bounds of 1-100 (default 20); comments/timeline keyset cursors and offset cursors for complete-list services. People/vocabulary remain bounded searches, while recents/mention candidates retain their 50-item service windows.
+- Client validation now uses QQQ bad-request exceptions, preserving standard 400/403/404 mapping and identical missing/invisible-parent errors. Active-person lookup added to the directory service.
+
+### Changed
+
+- Adopt core feature overrides, record capabilities and implied WRITE locks, reference metadata, mirrored locks, after-commit cleanup and summaries. Core registers feature permissions in the policy editor.
+- Replace `OtherUserAccess`/`UserSessionSupplier` with `CollaborationRecordAccessChecker` and core `UserSessionProviderInterface`; configure `withUserSessionProvider`.
+- Remove `ParentTableRestriction` and `TagFilterTranslator`; runtime `collaborationTags` filtering/search uses core subqueries. Retain the unpinned visibility fallback still missing from core.
+- Publish identifier-only realtime hints after commit. Selectable Tags output and the optional followers SPI await missing core hooks.
+
+- Build against locally installed QQQ `4.1.0-SNAPSHOT` until RC.6 is released; `qqq-middleware-javalin` is a compile dependency. Object storage remains pinned to `0.1.0-RC.2`.
+
+### Previously added
 - Phase-h links, share previews, recipient-safe notifications and SHARED followers; access requests with requester/admin locks, duplicate OPEN handling, optional permission-holder directory and streamed Mark granted/Decline outcomes.
 - Phase-i tasks with assignee validation, injectable-clock reminder/overdue receipts, complete/reopen/cancel, due-date cursor paging and streamed task actions.
 - Qbit owner/assignee services, configured Assign to/Take ownership bulk actions, My work summaries and mention read receipts.
@@ -25,12 +41,12 @@ All notable changes are documented here, following [Keep a Changelog](https://ke
 - Configurable notifier and recipient-session stand-ins, default no-op and recording transports, conservative unknown-access handling and RC.5 after-commit delivery with fresh access checks.
 - Follow preferences, generic streamed ETL Follow/Unfollow actions, configured RC.5 change listeners and a hidden minute scheduler for five-minute digests.
 - Timeline merging enforced core audit reads with collaboration activity, field-visibility filtering and tuple cursors. Attachments now record FILE_ADDED/FILE_REMOVED activity.
-- Memory-backed tests for recipient access, transactions, moderation, pagination, real ETL Review/Result, digest batching, directory ranking, schema and audit timeline security. Existing JaCoCo gates retained; endpoint publication deferred to #1128.
+- Memory-backed tests for recipient access, transactions, moderation, pagination, real ETL Review/Result, digest batching, directory ranking, schema and audit timeline security. Existing JaCoCo gates retained.
 
 - Phase-c attachments against QQQ 4.1.0-RC.5 and object storage 0.1.0-RC.2: parent-checked upload/list/download/rename/describe/delete service, bounded streaming, SHA-256 and configurable byte/extension limits.
 - Visible `collaboration_attachment` table, FIELD auditing, file-name/description search fields, virtual presigned FILE_PREVIEW/FILE_DOWNLOAD adornments, PostgreSQL BIGINT size and parent index, and an approximate count/bytes home card.
 - Temporary `ParentRecordAccess`, readable-table query restriction through RC.5's permission hook and parent post-filtering. Panel calls do not require the admin browse grant; direct attachment table writes are service-managed.
-- Streamed ETL **Delete attachments** Review/Result record action and retryable `AttachmentCleanup.onParentsDeleted` callback. No Attach files table action; endpoint integration awaits #1128 and cleanup registration awaits core.
+- Streamed ETL **Delete attachments** Review/Result record action and retryable `AttachmentCleanup.onParentsDeleted` callback. No Attach files table action; uploads now use the versioned UI API and cleanup registration awaits core.
 - Memory-backed attachment/security/process tests. Thumbnails use FILE_PREVIEW; `thumbnailKey` remains nullable/unused because object storage has no generator.
 
 - Repository scaffold; feature settings and people tables.
@@ -39,4 +55,3 @@ All notable changes are documented here, following [Keep a Changelog](https://ke
 - `FavoritesService` and `FavoriteEntry`: idempotent star/unstar, reorder/folders, refreshed labels, batched record visibility checks, unavailable-target redaction and Next UI paths.
 - `RecentsService`: persisted one-minute throttling, visible newest-first lists (up to 50), and hidden daily `collaborationTrimRecents` scheduling with configurable per-user retention (default 200).
 - Home row/distinct-user summaries, PostgreSQL 15+ unique indexes that treat null record IDs as equal, and memory-backend security/service/retention tests.
-- UI API endpoints (§10.2) deferred to a follow-up PR after QQQ's UI API extension point ([QRun-IO/qqq#1128](https://github.com/QRun-IO/qqq/pull/1128)) is released; no unreleased core classes are required.

README.md

@@ -1,6 +1,6 @@
 # QBit Collaboration
 
-Record collaboration for QQQ: attachments, tags, custom fields, comments with mentions, presence, sharing, favorites, follow, timeline and tasks. **Implemented now:** feature settings and people tables, favorites and recents services (phase b), per-user security, daily recents retention, phase-c attachments (upload/list/download/rename/delete, previews and parent cleanup), and the Collaboration app home with real session-scoped counts. Phase e adds comments/mentions, follow actions and digests, the audit/activity timeline, and automatic people-directory updates. Phase d adds tags, vocabulary policies, management and bulk actions, and standalone filter translation. Phases h/i add sharing/access requests, tasks/reminders, assignments and My work services. Phases f/g remain planned; general runtime overrides are still deferred. TAGS mode settings are read directly by the service.
+Record collaboration for QQQ: attachments, tags, custom fields, comments with mentions, presence, sharing, favorites, follow, timeline and tasks. **Implemented now:** feature settings and people tables, favorites and recents services (phase b), per-user security, daily recents retention, phase-c attachments (upload/list/download/rename/delete, previews and parent cleanup), and the Collaboration app home with real session-scoped counts. Phase e adds comments/mentions, follow actions and digests, the audit/activity timeline, and automatic people-directory updates. Phase d adds tags, vocabulary policies, management and bulk actions, and core-integrated tag filtering/search. Phases h/i add sharing/access requests, tasks/reminders, assignments and My work services. Phases f/g remain planned. Runtime overrides and TAGS mode settings resolve through core.
 
 Design: [QRun-IO/qqq PR #1136](https://github.com/QRun-IO/qqq/pull/1136), `docs/COLLABORATION.md`. See [the phase table](docs/DESIGN.md).
 
@@ -11,10 +11,10 @@ Comment parents list the selected thread's root and replies. Feature-setting sco
 ## Requirements
 
 - Java 21.
-- QQQ 4.1.0-RC.5 or newer compatible 4.1 release. The build pins RC.5.
+- QQQ `4.1.0-SNAPSHOT` installed from develop, including UI API extension point #1128. The build will move to `4.1.0-RC.6` once released; middleware Javalin is a compile dependency.
 - A configured QQQ backend supporting query, get, insert, update, delete, count and aggregate actions. PostgreSQL 15+ is the intended persistent store (the generated personal-target indexes use `NULLS NOT DISTINCT`); tests use the memory backend.
 - Attachments require `qbit-object-storage:0.1.0-RC.2` (a pinned dependency), installed with a PRIVATE bucket alias matching `attachmentsBucketName`. Configure its connection and credentials in the host; this qbit does not provision buckets.
-- Later phases and runtime overrides need the core contracts from the QQQ collaboration PRs. Favorites and recents use only APIs released in RC.5. String enum ids match the spec until the core collaboration enums are released.
+- Core feature resolution, permissions, reference security, summaries, query expansion and realtime use QQQ `4.1.0-SNAPSHOT`, targeting RC.6.
 
 ## Install
 
@@ -107,7 +107,6 @@ List<FavoriteEntry> recents = RecentsService.list(50);
 - Hrefs mirror Next's accepted flat routes: `/app/<table>/`, `/app/<table>/<id>/`, `/app/<app-or-process-or-report>/`, and `/app/<table>/savedView/<id>/`. Segments are URL-encoded. This avoids reconstructing nested app paths; trailing slashes support dotted process names.
 - Record views upsert a unique personal target. If its persisted `lastViewedAt` is less than 60 seconds ago, nothing is written; otherwise its timestamp, cached label and count update. The hidden backend-only `collaborationTrimRecents` process retains the newest `recentsPerUser` targets independently for each user, breaking timestamp ties by ID.
 
-The UI API endpoints in spec §10.2 will arrive in a **follow-up PR once QQQ's UI API extension point ([QRun-IO/qqq#1128](https://github.com/QRun-IO/qqq/pull/1128)) is released**. This PR adds no endpoint or unreleased core dependency. Runtime feature overrides and the record-feature summary SPI also await released core contracts; the home counts are implemented now.
 
 ## Attachments
 
@@ -131,13 +130,13 @@ File names are reduced to a safe basename (maximum 255 characters). Object keys
 
 The admin Attachments table additionally requires `collaboration.view` (or `collaboration.admin`). The panel service bypasses that browse grant only after its own parent/feature/ownership checks. Direct table insert/update/delete is denied; use the service and record action so storage and rows remain coordinated. Storage operations use `ObjectStorage.asSystem("collaboration", runId).bucket(alias)` after these checks, preserving calling-qbit/initiating-user operation logging without requiring users to hold `object_storage.*` grants.
 
-RC.5 has no PRE_QUERY customizer. `AttachmentSecurity` uses its custom permission checker as the pre-query hook, adding `tableName IN (readable parent tables)` to queries, counts and aggregates. Enable core permission enforcement for direct model API use. A POST_QUERY customizer checks each row's parent and removes invisible rows before signing any URLs. This applies to direct get/query as well as browsing. **Counts and aggregate bytes are approximate, and pages may be short** because parent record locks are checked after querying; the home labels the approximation. RC.5 cannot publish an `approximate` flag or refill pages through this hook. Replace this stand-in with core's record-reference security when released. Per-table feature enablement/settings and permission catalog integration also await those contracts.
+Core reference metadata now restricts parent tables/features and enforces parent visibility and record feature permissions. Direct writes remain service-only. The qbit retains its unpinned row-visibility fallback because core does not yet post-filter unmirrored parent locks or refill pages. Counts and aggregates remain approximate.
 
 **Preview and download.** The record view has `FILE_PREVIEW` and `FILE_DOWNLOAD` virtual fields, filled with five-minute presigned GETs only for visible rows (up to 200 rows per query). Downloads use RC.2's `PresignGet.downloadAs(fileName)`. RC.2 has no arbitrary response-header override for explicit inline disposition, so uploads store `Content-Disposition: inline`, and previews leave that header unchanged. URLs are never persisted. Images/PDF use the standard media preview; the host must allow its storage host in the frontend CSP (PDF frames need compatible `frame-src`). `thumbnailKey` is nullable and unused: object storage has no thumbnail generator, so thumbnails use FILE_PREVIEW rather than generated thumbnail files.
 
 **Actions and cleanup.** `Delete attachments` is a standard streamed ETL record action with Review/Result counts, skipped unauthorized rows, permission rechecks at execution and per-row failure summaries. It is not in navigation. Soft deletion follows the bucket's versioning/trash; without either, deletion is permanent. There is deliberately no **Attach files** table action: uploads come through the API/panel. The current browse action requires `collaboration.view`; the panel may call the service without that grant.
 
-After a parent deletion commits, trusted host code can call `new AttachmentCleanup().onParentsDeleted(table, ids)`. It deletes objects and rows in batches and is retryable. It cannot check an already-deleted parent and must never be exposed as a user endpoint. Wiring to core's `RecordReferenceCleanupInterface` waits for its release. UI API endpoints and the panel transport wait for [#1128](https://github.com/QRun-IO/qqq/pull/1128); direct/presigned upload endpoints and realtime events remain future integrations. Upload/delete now write FILE_ADDED/FILE_REMOVED activity. The table declares `fileName`/`description` search fields and uses normal QQQ writes, so host-configured record-change/ESB listeners receive events; this qbit does not install an ESB publication or Quick Search provider.
+After a parent deletion commits, trusted host code can call `new AttachmentCleanup().onParentsDeleted(table, ids)`. It deletes objects and rows in batches and is retryable. It cannot check an already-deleted parent and must never be exposed as a user endpoint. Wiring to core's `RecordReferenceCleanupInterface` waits for its release. UI API endpoints use the merged #1128 extension point from the locally installed snapshot; direct/presigned upload endpoints and realtime events remain future integrations. Upload/delete now write FILE_ADDED/FILE_REMOVED activity. The table declares `fileName`/`description` search fields and uses normal QQQ writes, so host-configured record-change/ESB listeners receive events; this qbit does not install an ESB publication or Quick Search provider.
 
 Tests use real QQQ memory actions and record locks plus an in-memory `AttachmentStorage` adapter. Object storage RC.2 exposes no fake bucket; its provider conformance suite uses MinIO/Testcontainers. This suite requires no Docker and does not claim MinIO/S3 conformance.
 
@@ -147,7 +146,7 @@ Run services in the caller's `QContext`. Register host tables before producing t
 
 ```java
 config.withNotifier(new QCodeReference(MyCollaborationNotifier.class))
-   .withUserSessionSupplier(new QCodeReference(MyUserSessions.class))
+   .withUserSessionProvider(new QCodeReference(MyUserSessions.class))
    .withFollowActionTables(List.of("order"))
    .withFollowChangeTables(List.of("order"))
    .withSchedulerName("scheduler");
@@ -174,7 +173,7 @@ TimelinePage timeline = new TimelineService().timeline("order", "123", null, 20,
 Classes live in the `comments`, `follow`, `timeline`, `people` and `notify` packages under `com.kingsrook.qbits.collaboration`.
 
 - Comments require visible parents and the `comment` feature check (explicit `<table>.comment` or table EDIT). Markdown is nonblank and at most 20,000 characters; clients must sanitize rendered HTML. Replies to replies attach to the root. Roots have null `threadId`; replies store the root ID in both thread/parent fields. Deleted DTO bodies are null. Authors alone edit; authors with comment permission or admins delete. Resolve/reopen applies only to roots. History follows parent READ.
-- Mentions use `@[Name](user:<userId>)`, deduplicate IDs and reject more than 50. `OtherUserAccess.canRead` returns `Optional<Boolean>` using a supplied recipient session and an enforced GetAction in a temporary context. Missing providers/sessions and mismatched identities are unknown. False/unknown recipients get neither record data nor automatic follows. Edits notify only previously unmentioned users. Mention delivery and ordinary follower delivery are deduplicated; authors never receive their own comment notifications.
+- Mentions use `@[Name](user:<userId>)`, deduplicate IDs and reject more than 50. `CollaborationRecordAccessChecker.canRead` returns `Optional<Boolean>` using a supplied recipient session and an enforced GetAction in a temporary context. Missing providers/sessions and mismatched identities are unknown. False/unknown recipients get neither record data nor automatic follows. Edits notify only previously unmentioned users. Mention delivery and ordinary follower delivery are deduplicated; authors never receive their own comment notifications.
 - `CommentEntry` includes author display name, capabilities, deleted/resolved state, mentions with visibility, and ordered replies. `CommentPage` pages 1–50 root threads by latest activity then ID, with replies oldest first. Pass `nextCursor` unchanged. Cursors are opaque, versioned Base64 tuple encodings, not authorization tokens.
 - Manual/assigned follow creation defaults change notifications on; other reasons default them off. Comment notifications default on. Existing preferences survive automatic follows and repeated calls; non-null arguments to `follow` change preferences. Follow needs only parent READ. The internal `ensureFollower` helper also verifies other-user access. Muted subscriptions are skipped until `mutedUntil` expires.
 - `FollowProcesses.processesFor(tableName)` returns the same Follow/Unfollow processes for manual host registration. Review performs no writes; Result rechecks permissions and reports successes/failures. They work with the host's actual primary-key field, not just `id`, and are never navigation entries.
@@ -185,7 +184,7 @@ Classes live in the `comments`, `follow`, `timeline`, `people` and `notify` pack
 
 The main comments/activity tables, revision/mention child joins and Followers child list are ordinary QQQ metadata. Direct API writes are refused; services authorize the actual parent. Shared `ParentTableRestriction` protects attachment and conversation queries/counts/aggregates; parent post-filtering protects row reads. Aggregate counts remain approximate and browse pages can be short for unmirrored parent locks. Raw persistence, activity writing and change-hook helpers are trusted internal boundaries and must not become public endpoints.
 
-UI API endpoints remain deferred to [QRun-IO/qqq#1128](https://github.com/QRun-IO/qqq/pull/1128). Runtime feature enablement, mirrored WRITE locks and core record-access/session contracts remain replacement points; the services do not claim to resolve feature-setting overrides. QAlerts.notify integration waits for #1125. Host-configured ESB listeners receive ordinary QQQ writes; realtime/UI and Quick Search provider registration remain host/later-phase integrations.
+UI API endpoints are described below. Runtime feature enablement, mirrored WRITE locks and core record-access/session contracts remain replacement points; the services do not claim to resolve feature-setting overrides. QAlerts.notify integration waits for #1125. Host-configured ESB listeners receive ordinary QQQ writes; realtime/UI and Quick Search provider registration remain host/later-phase integrations.
 
 ## Configuration
 
@@ -198,7 +197,7 @@ UI API endpoints remain deferred to [QRun-IO/qqq#1128](https://github.com/QRun-I
 | `blockedExtensions` | Empty | Case-insensitive extension denylist, with or without leading dots. |
 | `recentsPerUser` | `200` | Positive retention count per user. Enforced by the trim process. |
 | `notifier` | `QCodeReference(NoOpNotifier.class)` | Implements `CollaborationNotifier`; replace with a QAlerts.notify adapter when QRun-IO/qqq#1125 is released. |
-| `userSessionSupplier` | None | `QCodeReference` implementing `UserSessionSupplier`; missing user sessions mean unknown access. |
+| `userSessionProvider` | None | `QCodeReference` implementing `UserSessionProviderInterface`; missing user sessions mean unknown access. |
 | `followActionTables` | Empty | Existing host tables to receive standard Follow and Unfollow Review/Result processes. |
 | `followChangeTables` | Empty | Existing host tables whose UPDATE events should produce five-minute follow digests. |
 | `appName` | `collaboration` | Metadata name of the app. |
@@ -211,7 +210,7 @@ UI API endpoints remain deferred to [QRun-IO/qqq#1128](https://github.com/QRun-I
 2. For PostgreSQL, generate `CollaborationSchema.postgresScript(config)` and apply it with the host's migration tool. It creates tables and unique indexes, never executes DDL, and does not migrate existing schemas. QQQ owns date/default values on writes.
 3. Grant `collaboration.view` and `collaboration.admin` as appropriate; wire the host's audit persistence for FIELD audit events.
 4. Validate the assembled instance. Navigate to Collaboration for Comments, Attachments, Activity (admins), Feature Settings and People. People populate as signed-in users call collaboration services.
-5. Wait for the released core contracts and later qbit phases before enabling collaboration features on host records. Favorites, recents, attachments, comments, follow and timeline services can be used now. This phase installs no endpoints or host-table overlays; scheduled work is opt-in.
+5. Wait for the released core contracts and later qbit phases before enabling collaboration features on host records. Favorites, recents, attachments, comments, follow and timeline services can be used now. The versioned UI API is enabled by default; host-table overlays remain separate and scheduled work is opt-in.
 
 ## Build
 
@@ -273,23 +272,104 @@ multi-select belongs to the separate Next UI phase. The qbit tests exercise the
 submitted arrays and real streamed Review/Result lifecycle.
 
 `AttachmentCleanup.onParentsDeleted` now also removes tag assignments and
-recounts vocabulary usage. Hosts keep using this trusted callback until the core
-cleanup registration contract ships. The home shows session-visible vocabulary
+recounts vocabulary usage. Core invokes `CollaborationCleanup` after committed parent deletion. The home shows session-visible vocabulary
 size, pending suggestions, and the five most-used approved tags.
 
-`TagFilterTranslator.recordIds(table, operatorName, tags)` supports `IN` (any),
-`CONTAINS_ALL`, `NOT_IN` (none), `IS_BLANK`, and `IS_NOT_BLANK`. Every operator
-returns matching visible parent IDs as strings, including complements. Exactly
-10,000 results are allowed; larger results throw. Unknown tags match nothing;
-empty IN matches nothing and empty CONTAINS_ALL/NOT_IN match all visible parents.
-Numeric inputs are IDs, strings are normalized names; if a global and local tag
-share a name, the global tag wins (use IDs to disambiguate).
+`collaborationTags` is a virtual STRING field labeled Tags with possible-value source `collaboration_tag`. `TagCriteriaExpander` supports IN, NOT_IN, EQUALS, NOT_EQUALS, IS_BLANK, IS_NOT_BLANK and CONTAINS_ALL using core `QSubQuery` membership filters. Ordinary quick search matches labels; `#name` matches normalized names. Numeric criteria are tag IDs; string criteria are names. The old ID materializer is removed. Core owns SQL execution or bounded cross-backend materialization; its bound applies to inner rows, not final parent matches.
 
-**Filter/quick-search integration lands after QRun-IO/qqq#1140 is released.** This
-phase does not register a virtual filter field, core expander, `QSubQuery`, tag
-column filler, or `#tag`/host-record quick-search provider. The standalone
-translator deliberately imports none of those unreleased types.
+The runtime provider adds this field and its search entry where TAGS is enabled. It is queryable but not selectable: the overlay has no virtual-field post-query hook and existing host customizers must be preserved.
 
+## UI API
+
+The producer registers extension `collaboration` version `1.0.0` at
+`/qqq/v1/qbit/collaboration`. It uses the signed-in user's session and existing
+services. Disable registration with `new CollaborationQBitConfig().withUiApi(false)`.
+Presence, shares, tasks, my-work, direct upload and thumbnail routes are not part
+of this extension version.
+
+All successes return HTTP 200. All bodies have named `Collaboration*V1` schemas
+in [the extension contract](src/main/resources/openapi/qqq-v1/collaboration.yaml).
+The server publishes these alongside core at `/qqq/v1/openapi.yaml` and `.json`.
+
+| Method | Path (relative to `/qqq/v1/qbit/collaboration`) | Purpose | Request schema | Response schema |
+|---|---|---|---|---|
+| GET | `/favorites` | List personal favorites | — | `CollaborationFavoriteListV1` |
+| PUT | `/favorites` | Star a target | `CollaborationTargetRequestV1` | `CollaborationMutationResultV1` |
+| DELETE | `/favorites` | Unstar a target | `CollaborationTargetRequestV1` | `CollaborationMutationResultV1` |
+| POST | `/recents` | Record a recent view | `CollaborationTargetRequestV1` | `CollaborationMutationResultV1` |
+| PATCH | `/favorites/order` | Reorder personal favorites | `CollaborationFavoriteOrderRequestV1` | `CollaborationMutationResultV1` |
+| GET | `/recents` | List recent targets | — | `CollaborationRecentListV1` |
+| GET | `/records/{table}/{pk}/attachments` | List record attachments | — | `CollaborationAttachmentListV1` |
+| GET | `/attachments/{id}/download` | Get a temporary download URL; clients follow url | — | `CollaborationDownloadV1` |
+| GET | `/attachments/{id}/preview` | Get a temporary preview URL; clients follow url | — | `CollaborationDownloadV1` |
+| PATCH | `/attachments/{id}` | Rename or describe an attachment | `CollaborationAttachmentPatchRequestV1` | `CollaborationAttachmentV1` |
+| DELETE | `/attachments/{id}` | Delete an attachment | — | `CollaborationMutationResultV1` |
+| GET | `/tags` | Search table tag vocabulary | — | `CollaborationTagListV1` |
+| POST | `/tags` | Create or suggest a tag | `CollaborationTagCreateRequestV1` | `CollaborationTagV1` |
+| GET | `/records/{table}/{pk}/tags` | List applied record tags | — | `CollaborationTagListV1` |
+| PUT | `/records/{table}/{pk}/tags` | Add and remove record tags | `CollaborationTagApplyRequestV1` | `CollaborationTagListV1` |
+| GET | `/records/{table}/{pk}/comments` | Page record comment threads | — | `CollaborationCommentPageV1` |
+| POST | `/records/{table}/{pk}/comments` | Post a comment or reply | `CollaborationCommentPostRequestV1` | `CollaborationCommentV1` |
+| PATCH | `/comments/{id}` | Edit the caller's comment | `CollaborationCommentEditRequestV1` | `CollaborationCommentV1` |
+| DELETE | `/comments/{id}` | Delete a comment thread | — | `CollaborationMutationResultV1` |
+| POST | `/comments/{id}/resolve` | Resolve a comment thread | — | `CollaborationMutationResultV1` |
+| POST | `/comments/{id}/reopen` | Reopen a comment thread | — | `CollaborationMutationResultV1` |
+| GET | `/comments/{id}/history` | Read comment edit history | — | `CollaborationCommentHistoryV1` |
+| GET | `/mentions/candidates` | Find people to mention on a record | — | `CollaborationMentionCandidateListV1` |
+| GET | `/records/{table}/{pk}/follow` | Get the caller's follow state | — | `CollaborationFollowStateV1` |
+| PUT | `/records/{table}/{pk}/follow` | Follow a record and configure notifications | `CollaborationFollowRequestV1` | `CollaborationFollowStateV1` |
+| DELETE | `/records/{table}/{pk}/follow` | Unfollow a record | — | `CollaborationFollowStateV1` |
+| GET | `/records/{table}/{pk}/followers` | List record followers | — | `CollaborationFollowerListV1` |
+| GET | `/records/{table}/{pk}/timeline` | Page the merged record timeline | — | `CollaborationTimelinePageV1` |
+| GET | `/people` | Search the active people directory | — | `CollaborationPersonListV1` |
+| GET | `/people/{userId}` | Get an active directory person | — | `CollaborationPersonV1` |
+| POST | `/records/{table}/{pk}/attachments` | Upload one file (multipart) | `CollaborationAttachmentUploadRequestV1` | `CollaborationAttachmentV1` |
+
+List requests accept `limit` (default 20, range 1-100). Responses include
+`nextCursor`: pass it as `cursor` to continue. Comments page root threads by last
+activity; replies are oldest first. Timeline uses its `(at, kind, id)` keyset and
+also accepts `before` as an alias for `cursor` (supply only one), plus comma-separated
+`types` (`AUDIT`, `ACTIVITY`, or activity names such as `COMMENTED`). Complete-list
+services use opaque offset cursors and recheck visibility on every request;
+concurrent list changes may shift offsets. Recents and mention candidates retain
+their service's 50-item window. People and vocabulary search accept `q` and `limit`
+only and return null `nextCursor`; narrow the search to find more matches. Tag apply
+returns the full resulting tag set.
+
+Upload is real `multipart/form-data`, with exactly one binary part named `file`
+and an optional text `description`. The direct `AbstractEndpointSpec` reads Javalin's
+uploaded parts and streams the file to `AttachmentsService`, which enforces parent
+access, filename rules and bounded storage. Hosts retain the default
+`AttachmentStorage` adapter backed by object storage RC.2; an alternative adapter
+can be configured with `withAttachmentStorage(new QCodeReference(Adapter.class))`.
+
+Download and preview both return `CollaborationDownloadV1 {url}` with status 200:
+**clients follow url**. The presigned URL lasts five minutes. Download requests an
+attachment filename; preview requests inline content. QQQ's current OpenAPI
+`Response` model cannot declare the `Location` header, so this contract uses the
+JSON URL alternative consistently.
+
+A missing or invisible parent returns identical `404 {"error":"Not found"}`.
+Missing write permissions return 403; invalid input returns 400 with an `error`
+message through QQQ's exception mapper. Provider/backend failures remain server
+errors. Services continue to own author, record-lock and permission checks.
+Mention candidates expose `canRead` as the string enum `"true"`, `"false"`,
+`"unknown"`; unknown does not imply the recipient can read the record.
+
+QQQ's schema model currently lacks object-property `required` and numeric
+minimum/maximum keywords. Required fields and limit bounds are described in the
+schemas and enforced at runtime; the request body itself is marked required.
+
+Regenerate the fragment after intentionally changing the contract:
+
+```powershell
+.\mvnw.cmd -o -q '-Dtest=CollaborationApiContractTest' '-Dcollaboration.openapi.update=true' test
+```
+
+Normal `mvnw.cmd -o -q verify` checks the fragment without modifying it, runs real
+HTTP integration tests on a free port with the memory backend, and retains the
+70% instruction / 90% class coverage gates. This is the first release of the
+extension, so there is no prior release baseline yet.
 ## Sharing and work services (phases h/i)
 
 Services run in the caller's `QContext`. UI API endpoints and screens follow in a separate PR.
@@ -393,3 +473,40 @@ idempotent hook. Schema generation includes the four tables, supporting indexes
 `ALTER TABLE collaboration_mention ADD COLUMN IF NOT EXISTS read_at TIMESTAMPTZ` for upgrades.
 Hosts apply generated SQL through their migration tooling; ESB/search publication uses the same
 host integrations as other collaboration tables.
+
+
+## Core contracts and completed UI API
+
+The qbit targets QQQ RC.6 using the locally installed `4.1.0-SNAPSHOT`. Defaults enable FAVORITES, RECENTS and TIMELINE for eligible host tables; all other features start off. Configure before producing metadata:
+
+```java
+config.withDefaultFeatures(RecordFeature.FAVORITES, RecordFeature.RECENTS, RecordFeature.TIMELINE)
+   .withTableFeatures("order", RecordFeature.TAGS, RecordFeature.COMMENTS, RecordFeature.FOLLOW)
+   .withMirroredSecurityKeyTypes(List.of("clientId"))
+   .withUserSessionProvider(new QCodeReference(MyUserSessions.class));
+```
+
+`withTableFeatures` supplies the complete enabled set for that table. Host declarations and hard limits use `RecordFeaturesMetaData`. After declaring host tables and producing/enriching the instance, call `RuntimeMetaDataOverlay.refresh(instance)` after database initialization with that instance in `QContext`, as required by core. This loads stored policy and initial runtime fields. Feature-setting insert/update/delete refresh again after commit. Rollback discards callbacks; invalid contributions retain the previous accepted snapshot.
+
+Feature permissions appear automatically in the policy editor through core enrichment. Record-level implied EDIT grants also require the parent's WRITE locks. `mirroredSecurityKeyTypes` defaults to none; configured keys add `lockKey_<type>` fields, null-ALLOW locks and PostgreSQL columns/ALTER statements. Apply generated DDL before enabling the configuration. Core propagates parent lock changes. Revisions and mentions already carry denormalized references in this schema and receive core protection too.
+
+`CollaborationCleanup` removes attachments, tags, work and conversation data after committed parent deletion, retaining access requests. `CollaborationRecordAccessChecker` implements `RecordAccessCheckerInterface` through core `UserSessionProviderInterface.sessionForUser`; missing/mismatched recipient sessions mean unknown access. `CollaborationSummaryProvider` fills core `GET /qqq/v1/table/{table}/{pk}/features` with favorite/follow state, open comment/task counts, attachment/tag/follower counts and owner/assignee values.
+
+New routes, all under `/qqq/v1/qbit/collaboration`:
+
+| Method | Path |
+| --- | --- |
+| GET | `/records/{table}/{pk}/link` |
+| POST | `/records/{table}/{pk}/shares/preview` |
+| POST | `/records/{table}/{pk}/shares` |
+| POST | `/access-requests` |
+| GET | `/access-requests/mine` |
+| GET, POST | `/records/{table}/{pk}/tasks` |
+| PATCH | `/tasks/{id}` |
+| GET | `/tasks/mine` |
+| PUT | `/records/{table}/{pk}/assignment` |
+| GET | `/my-work` |
+
+Typed `CollaborationWorkSchemas` describe requests and results. Task PATCH preserves omitted fields, accepts OPEN/DONE/CANCELLED transitions, and permits explicit null for optional fields; null `remindAt` selects the service's due-date default. Assignment PUT replaces owner and assignee; null clears. Invalid input is 400, denied visible-record operations are 403, and missing/invisible parents are 404. Access requests deliberately never inspect parent existence. The extension stays at unreleased **1.0.0**; contract tooling accepts these additions without a bump.
+
+`CollaborationRealtime` publishes `comment.added/updated/deleted`, `attachment.changed`, `tags.changed` and `task.changed` on `record:{table}:{pk}` after commit. Successful notification delivery publishes `notification.created` on `user:{userId}`. Payloads contain identifiers only. The optional followers provider is skipped because `RecordFollowersProviderInterface` is absent from the installed jar. Selectable Tags values remain unavailable because the overlay has no output hook.

docs/DESIGN.md

@@ -2,7 +2,7 @@
 
 The authoritative design is [QRun-IO/qqq PR #1136](https://github.com/QRun-IO/qqq/pull/1136), `docs/COLLABORATION.md` ([develop document](https://github.com/QRun-IO/qqq/blob/develop/docs/COLLABORATION.md)).
 
-Collaboration adds metadata-driven record features to QQQ: attachments, tags, custom fields, comments and mentions, presence, sharing, favorites, follow, timeline, recents, tasks and assignment. Core owns security, query and runtime metadata contracts; this qbit owns visible `collaboration_*` tables and feature services. Implemented: phase-a configuration, feature settings and people tables, plus phase-b favorites/recents tables, services, owner locks, retention and home counts against QQQ 4.1.0-RC.5. The phase-b UI API endpoints await the released extension point from QRun-IO/qqq#1128. The override and record-feature summary providers await released core contracts; phase-c attachments are implemented on object storage 0.1.0-RC.2; phase e comments/follow/timeline is implemented against released RC.5; phase d tags and phases h/i sharing, tasks and ownership services are implemented. Phases f/g and endpoint publication remain separate work. The table below is the full roadmap from the specification, not a list of shipped functionality.
+Collaboration supplies visible `collaboration_*` tables, feature services and 42 typed UI API operations. QQQ `4.1.0-SNAPSHOT` (target RC.6) owns feature resolution, permission registration, reference security, mirrored locks, virtual criteria, record summaries and realtime transport. Object storage remains `0.1.0-RC.2`.
 
 | Phase | Core | Qbit | Next UI |
 |---|---|---|---|
@@ -19,40 +19,35 @@ Collaboration adds metadata-driven record features to QQQ: attachments, tags, cu
 
 ## Phase-c implementation choices
 
-- `ParentRecordAccess` is the named replacement point for the unreleased core helper. GetAction enforces parent READ and locks. Attach is an explicit feature grant or EDIT plus visible parent; separate WRITE locks remain an approximation.
+- `ParentRecordAccess` delegates to core visibility and feature capabilities. Attach requires the core feature grant or implied EDIT with parent WRITE locks.
 - Admin browsing requires collaboration.view, while panel service calls authorize the parent directly. Direct table writes are denied. Internal persistence uses explicit per-action permission bypasses after service checks, and per-input metadata clones without preview customizers. The caller's session is never elevated or replaced. Cloning also lets delete prefetch find rows after the parent is deleted, while preserving FIELD audits and record-change listeners.
-- RC.5 offers no PRE_QUERY customizer. The attachment permission checker adds a readable-table IN filter before query/count/aggregate; POST_QUERY filters parent locks before presigning. Approximate counts/bytes and short pages are documented. Full mirrored locks, page refill and API approximate flags await core.
+- Core adds readable-table/feature restrictions before query/count/aggregate and enforces configured mirrored locks. The retained POST_QUERY fallback protects unmirrored parent locks before presigning. Page refill and exact unpinned counts remain an upstream limitation.
 - Uploads spool to bounded temporary disk while hashing; no full-file heap buffer. The bucket cap also applies. Keys contain a UUID and safe basename; renames do not move bytes. Object/row writes are ordered with best-effort compensation, not a distributed transaction.
 - The object-storage adapter uses the calling-qbit system facade only after authorization. Soft deletion follows bucket policy. Object retention failures leave retryable rows. In-memory adapter tests exercise QQQ actions and security; provider conformance stays with object storage's MinIO suite.
 - Previews/downloads are virtual fields in the RECORD_VIEW alternative section (RC.5 disallows virtual fields in base sections). Five-minute URLs are never stored. RC.2 supports attachment filename overrides, but not explicit inline overrides; uploads carry an inline header. There is no thumbnail generator or generated thumbnail file.
-- Delete attachments uses standard streamed ETL. Attach files is omitted for API/panel uploads. Cleanup is a trusted public after-commit callback pending RecordReferenceCleanupInterface. Endpoints await #1128; runtime feature settings and realtime publication are future integrations; attachment services now write activity. Native search fields are present; ESB and Quick Search publication are host integrations.
+- Delete attachments uses standard streamed ETL. Attach files is omitted for API/panel uploads. Cleanup implements RecordReferenceCleanupInterface. Typed endpoints, runtime settings and realtime publication are integrated; attachment services now write activity. Native search fields are present; ESB and Quick Search publication are host integrations.
 
 See [README](../README.md#attachments) for the service contract, permissions and configuration.
 
 
 ## Phase-e implementation choices
 
-- **Released core only.** RC.5 includes record-change listeners and transaction after-commit callbacks. The producer registers a listener only when `followChangeTables` is nonempty. Notification delivery uses the context transaction; temporary recipient contexts never inherit the caller's permission-bypass scope. The notifier/access interfaces are explicit stand-ins for #1125 and the unreleased recipient/session contracts.
-- **Security at both boundaries.** Services check the real parent before disclosing any row. Direct table writes are denied even to admins. `ParentTableRestriction` adds a READ-table condition outside caller OR clauses; `ParentRowCustomizer` checks record locks on fetched rows. Revision and mention rows mirror their comment's parent reference to use the same pre-query restriction. Core mirrored locks/page refill and runtime feature resolution remain deferred; counts and unpinned page lengths have the same limits as attachments.
+- **Released core only.** RC.5 includes record-change listeners and transaction after-commit callbacks. The producer registers a listener only when `followChangeTables` is nonempty. Notification delivery uses the context transaction; temporary recipient contexts never inherit the caller's permission-bypass scope. The notifier remains an adapter for #1125; recipient access implements core access/session contracts.
+- **Security at both boundaries.** Services check the real parent before disclosing any row. Direct table writes are denied even to admins. Core reference metadata adds parent-table and feature restrictions; `ParentRowCustomizer` checks record locks on fetched rows. Revision and mention rows mirror their comment's parent reference to use the same pre-query restriction. Configured mirrored locks and runtime resolution use core; unpinned post-filtering/page refill remain incomplete upstream; counts and unpinned page lengths have the same limits as attachments.
 - **Conversations are persisted relationships.** Roots have null thread IDs; replies flatten to a root. `lastActivityAt` is maintained on roots to support indexed keyset paging. Revisions retain the old body. Mention uniqueness prevents re-notification on subsequent edits. Visible mentions auto-follow; unknown is never a grant. Notifications deduplicate mentions versus followers and recheck access after commit. The default no-op transport does not mark mentions delivered.
 - **Durable follow batches.** The additional standard `collaboration_follow_digest` table stores one pending batch per parent/recipient. Due time is fixed at the first change plus five minutes. Record-change listeners copy event data and queue only after commit; batches contain field/actor summaries, never old/new values. Delivery rechecks current follow preferences and recipient access. One scheduled sender per installation is required; local synchronization and a unique key are not a cross-pod lease. Delivery/delete is at-least-once across a process crash; adapter idempotency is needed for stronger delivery guarantees.
 - **Audit reads preserve the user's authority.** Timeline uses core's released audit table names/fields with ENFORCE on every query, then applies core table personalization to field details. Headers are queried separately from details so a joined-row limit cannot cut an event in half. Denied audits are omitted. Core stores audit actor names without stable session user IDs; the DTO leaves those IDs null. Both streams are bounded and merged by descending `(at, kind, id)`. Cursor IDs are compared as numeric strings because RC.5's memory equality distinguishes Integer and Long values.
 - **Directory throttling is persistent.** Ten-minute last-seen checks survive service recreation and rollback without maintaining an in-memory cache. QUser supplies full name/ID only; email/avatar enrichment stays with trusted host integrations. Mention ranking queries participants first so the limit cannot hide an existing follower behind many other users.
 - **User-facing metadata.** Comments and admin-only Activity are main nav tables. Revisions, mentions and Followers are child lists; digest/follow tables are admin-browsable with HIDDEN deny behavior. Follow actions use generic streamed ETL Review/Result against any host key. The home reads real session-scoped comments/open-thread/follower counts. Standard QQQ writes remain available to host ESB listeners.
 
-The service API and configuration are documented in [README](../README.md#comments-follow-and-timeline). Endpoints remain deferred to QRun-IO/qqq#1128; no unreleased core dependency, runtime overlay, mirrored-lock implementation or realtime/UI delivery is introduced.
+The service API and configuration are documented in [README](../README.md#comments-follow-and-timeline). Endpoints use the core extension API; overlay, mirrored locks and realtime use the local core snapshot.
 
 ## Phase-d implementation choices
 
-- **RC.5 boundary.** `tags/TagFilterTranslator` uses operator names, QQQ queries and
-  string parent IDs. It returns matching rows for all operators, so NOT_IN and
-  IS_BLANK enumerate the visible host-table complement. The 10,000 limit applies
-  to final matching IDs, not assignment count. It pages parent reads under the
-  caller's permissions and locks. Filter/quick-search integration lands after
-  QRun-IO/qqq#1140 is released; no unreleased core types or virtual fields are used.
+- **Core query boundary.** `TagCriteriaExpander` returns core subqueries over record tags, preserving AND/OR and complement semantics. Runtime metadata adds the Tags field and search entry where enabled. TEXT matches labels and TAG matches normalized names. Selectable values await a core virtual-field output hook.
 - **Vocabulary versus assignments.** Tag names are unique per nullable scope;
   PostgreSQL DDL emits NULLS NOT DISTINCT for nullable unique-key components.
-  Record Tags inherits `ParentTableRestriction` and the parent row customizer,
+  Record Tags uses core reference metadata and the unpinned parent row fallback,
   including the existing approximation for aggregate counts and short pages.
   Vocabulary pickers need no collaboration.view grant: ordinary users see
   approved tags and their own suggestions in readable scopes, while manage sees
@@ -81,7 +76,7 @@ The service API and configuration are documented in [README](../README.md#commen
   for the separate Next client; RC.5 itself has no native multi-value form field.
 - **Presentation.** Tags is in the admin app nav; Record Tags is a child widget.
   The home queries under the caller session and HTML-escapes labels. Native tag
-  label search metadata is present; host-record tag search awaits #1140.
+  label search and host-record tag search use the core virtual-field expander.
 
 
 ## Phases h/i implementation choices
@@ -118,3 +113,16 @@ The service API and configuration are documented in [README](../README.md#commen
 
 See the README for service signatures, defaults, configuration and the exact access-request
 prefill route. UI API endpoints and screens follow in their separate PR.
+
+
+## RC.6 integration boundaries
+
+`CoreCollaboration` installs configuration defaults, feature-setting overrides, runtime Tags metadata, summaries and cleanup providers. Core enrichment registers feature permissions. `ParentRecordAccess` is a canonical-key wrapper around core visibility and record capability checks, including WRITE locks for implied grants. Every extension reference table declares core metadata; revision/mention rows already carry denormalized references alongside their comment joins. Author restrictions apply where appropriate; tags and tasks retain their collaborative service rules.
+
+Core still lacks unpinned row post-filter/refill support for unmirrored locks. Retained row/attachment filters protect that gap and redact tombstones; projected reads include the reference fields needed by these filters. Counts remain approximate. Mirrors default to none and generated DDL includes ALTER statements when configured. Cleanup uses private metadata without reference checks because the parent is gone. Share acknowledgement is a separate, recipient-verified exception that changes only receipt time.
+
+Feature writes refresh the overlay after commit. Initial loading follows core's startup contract: refresh after enrichment and database setup. The Tags contribution resolves incoming policy before core publishes its new snapshot. No selectable virtual values are advertised, because the overlay has no output hook. The installed core jar also lacks the optional followers SPI.
+
+`CollaborationWorkSchemas` and endpoint specs expose sharing, access requests, tasks, assignment and My work; the README and generated OpenAPI contain the route list. Task PATCH validates before writing and preserves omitted fields. Access requests never inspect parent existence. Contract version remains unreleased 1.0.0.
+
+`CollaborationRealtime` merges stored references for partial updates, captures immutable identifier payloads and publishes after commit. Notification hints follow actual delivery. Rollback discards callbacks. Bus failure is best-effort and does not fail a committed write.

pom.xml

@@ -76,6 +76,10 @@
          <groupId>com.kingsrook.qqq</groupId>
          <artifactId>qqq-backend-core</artifactId>
       </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-middleware-javalin</artifactId>
+      </dependency>
       <dependency>
          <groupId>org.junit.jupiter</groupId>
          <artifactId>junit-jupiter</artifactId>
@@ -173,14 +177,14 @@
    <profiles>
       <!-- Built against qqq 4.1 (QBitMetaDataProducer). Until qbit-build-parent  -->
       <!-- imports the released 4.1 BOM, this profile is active by default and     -->
-      <!-- imports qqq-bom-pom 4.1.0-RC.5 ahead of the parent's 4.0.0 BOM.         -->
+      <!-- imports qqq-bom-pom 4.1.0-RC.6 ahead of the parent's 4.0.0 BOM.         -->
       <profile>
          <id>qqq-snapshot</id>
          <activation>
             <activeByDefault>true</activeByDefault>
          </activation>
          <properties>
-            <qqq.snapshot.version>4.1.0-RC.5</qqq.snapshot.version>
+            <qqq.snapshot.version>4.1.0-RC.6</qqq.snapshot.version>
          </properties>
          <dependencyManagement>
             <dependencies>

src/main/java/com/kingsrook/qbits/collaboration/CollaborationCleanup.java

@@ -0,0 +1,63 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.io.Serializable;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentCleanup;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.actions.collaboration.RecordReferenceCleanupInterface;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Core invokes cleanup once the parent deletion commits.
+ *******************************************************************************/
+public class CollaborationCleanup implements RecordReferenceCleanupInterface
+{
+   /*******************************************************************************
+    ** Existing attachment cleanup includes tag counts, shares, tasks and assignments.
+    *******************************************************************************/
+   @Override
+   public void onParentsDeleted(String tableName, List<Serializable> primaryKeys) throws QException
+   {
+      new AttachmentCleanup().onParentsDeleted(tableName, primaryKeys);
+      for(String table : List.of(CollaborationTables.COMMENT_REVISION, CollaborationTables.MENTION, CollaborationTables.COMMENT,
+         CollaborationTables.FOLLOW_DIGEST, CollaborationTables.FOLLOW, CollaborationTables.ACTIVITY))
+      {
+         while(true)
+         {
+            var rows = CollaborationRecords.cleanupQuery(table, new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, tableName)
+               .withCriteria("recordId", QCriteriaOperator.IN, primaryKeys.stream().map(Object::toString).toList()).withLimit(200));
+            if(rows.isEmpty())
+            {
+               break;
+            }
+            for(var row : rows)
+            {
+               CollaborationRecords.cleanupDelete(table, row.getValue("id"));
+            }
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/CollaborationQBitConfig.java

@@ -22,10 +22,14 @@
 package com.kingsrook.qbits.collaboration;
 
 
+import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Map;
 import com.kingsrook.qbits.collaboration.notify.NoOpNotifier;
 import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
 import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeature;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeaturesMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitConfig;
 import com.kingsrook.qqq.backend.core.utils.StringUtils;
 
@@ -38,8 +42,12 @@ public class CollaborationQBitConfig implements QBitConfig
    public static final String TABLE_NAME_PREFIX = "collaboration_";
    public static final String PERMISSION_BASE_NAME = "collaboration";
 
+   private List<RecordFeature> defaultFeatures = List.of(RecordFeature.FAVORITES, RecordFeature.RECENTS, RecordFeature.TIMELINE);
+   private Map<String, List<RecordFeature>> tableFeatures = new LinkedHashMap<>();
+   private List<String> mirroredSecurityKeyTypes = List.of();
+
    private QCodeReference notifier = new QCodeReference(NoOpNotifier.class);
-   private QCodeReference userSessionSupplier = null;
+   private QCodeReference userSessionProvider = null;
    private String defaultTagMode = "FREE";
    private List<String> tagActionTables = List.of();
    private List<String> followActionTables = List.of();
@@ -52,11 +60,47 @@ public class CollaborationQBitConfig implements QBitConfig
    private String appName = "collaboration";
    private String parentAppName;
    private Boolean adminApp = true;
+   private Boolean uiApi = true;
+   private QCodeReference attachmentStorage = new QCodeReference(com.kingsrook.qbits.collaboration.attachments.AttachmentStorage.class);
    private Integer recentsPerUser = 200;
    private String attachmentsBucketName = "collaboration";
    private Long defaultMaxBytes = 100L * 1024 * 1024;
    private List<String> blockedExtensions = List.of();
 
+   /*******************************************************************************
+    ** Whether the versioned collaboration UI API is registered.
+    *******************************************************************************/
+   public Boolean getUiApi()
+   {
+      return (uiApi);
+   }
+
+   /*******************************************************************************
+    ** Enable or disable the versioned UI API (enabled by default).
+    *******************************************************************************/
+   public CollaborationQBitConfig withUiApi(Boolean uiApi)
+   {
+      this.uiApi = uiApi;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Storage boundary used by attachment operations, including HTTP uploads.
+    *******************************************************************************/
+   public QCodeReference getAttachmentStorage()
+   {
+      return (attachmentStorage);
+   }
+
+   /*******************************************************************************
+    ** Configure a storage adapter; the default uses qbit-object-storage.
+    *******************************************************************************/
+   public CollaborationQBitConfig withAttachmentStorage(QCodeReference attachmentStorage)
+   {
+      this.attachmentStorage = attachmentStorage;
+      return (this);
+   }
+
 
 
    /*******************************************************************************
@@ -396,19 +440,19 @@ public class CollaborationQBitConfig implements QBitConfig
    }
 
    /*******************************************************************************
-    ** Get userSessionSupplier.
+    ** Get userSessionProvider.
     *******************************************************************************/
-   public QCodeReference getUserSessionSupplier()
+   public QCodeReference getUserSessionProvider()
    {
-      return (userSessionSupplier);
+      return (userSessionProvider);
    }
 
    /*******************************************************************************
-    ** Configure userSessionSupplier.
+    ** Configure userSessionProvider.
     *******************************************************************************/
-   public CollaborationQBitConfig withUserSessionSupplier(QCodeReference userSessionSupplier)
+   public CollaborationQBitConfig withUserSessionProvider(QCodeReference userSessionProvider)
    {
-      this.userSessionSupplier = userSessionSupplier;
+      this.userSessionProvider = userSessionProvider;
       return (this);
    }
 
@@ -530,4 +574,59 @@ public class CollaborationQBitConfig implements QBitConfig
       this.assignActionTables = value;
       return (this);
    }
+
+   /*******************************************************************************
+    ** Replace the instance feature defaults.
+    *******************************************************************************/
+   public CollaborationQBitConfig withDefaultFeatures(RecordFeature... features)
+   {
+      defaultFeatures = List.of(features);
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Declare the complete enabled feature set for a host table.
+    *******************************************************************************/
+   public CollaborationQBitConfig withTableFeatures(String table, RecordFeature... features)
+   {
+      tableFeatures.put(table, List.of(features));
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Apply code declarations before core enrichment and permission registration.
+    *******************************************************************************/
+   public void applyFeatures(QInstance instance)
+   {
+      RecordFeaturesMetaData defaults = RecordFeaturesMetaData.ofOrWithNew(instance);
+      for(RecordFeature feature : RecordFeature.values())
+      {
+         defaults.getEnabled().putIfAbsent(feature, defaultFeatures.contains(feature));
+      }
+      tableFeatures.forEach((name, features) ->
+      {
+         RecordFeaturesMetaData metadata = RecordFeaturesMetaData.ofOrWithNew(instance.getTable(name));
+         for(RecordFeature feature : RecordFeature.values())
+         {
+            metadata.withEnabled(feature, features.contains(feature));
+         }
+      });
+   }
+
+   /*******************************************************************************
+    ** Parent security key types copied into extension tables; none by default.
+    *******************************************************************************/
+   public List<String> getMirroredSecurityKeyTypes()
+   {
+      return (mirroredSecurityKeyTypes);
+   }
+
+   /*******************************************************************************
+    ** Configure mirrored parent locks.
+    *******************************************************************************/
+   public CollaborationQBitConfig withMirroredSecurityKeyTypes(List<String> types)
+   {
+      mirroredSecurityKeyTypes = List.copyOf(types);
+      return (this);
+   }
 }

src/main/java/com/kingsrook/qbits/collaboration/CollaborationQBitProducer.java

@@ -134,7 +134,6 @@ public class CollaborationQBitProducer implements QBitMetaDataProducer<Collabora
       {
          WorkProcesses.assignments(table).forEach(output::add);
       }
-      instance.withRecordChangeListener(new com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference(WorkCleanup.class));
       output.add(com.kingsrook.qbits.collaboration.follow.SendFollowDigestsProcess.metadata(qBitConfig));
       for(String table : qBitConfig.getFollowActionTables())
       {
@@ -165,6 +164,12 @@ public class CollaborationQBitProducer implements QBitMetaDataProducer<Collabora
          output.add(CollaborationHome.app(qBitConfig));
       }
       output.addSelfToInstance(instance);
+      CoreCollaboration.install(instance, qBitConfig);
+      instance.withRecordChangeListener(new com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference(CollaborationRealtime.class));
+      if(Boolean.TRUE.equals(qBitConfig.getUiApi()))
+      {
+         com.kingsrook.qbits.collaboration.api.CollaborationApi.register(instance);
+      }
       com.kingsrook.qbits.collaboration.model.ConversationChildren.install(instance);
       if(Boolean.TRUE.equals(qBitConfig.getAdminApp()) && qBitConfig.getParentAppName() != null)
       {

src/main/java/com/kingsrook/qbits/collaboration/CollaborationRealtime.java

@@ -0,0 +1,104 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeEvent;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeListenerInterface;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeType;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.logging.QLogger;
+import com.kingsrook.qqq.backend.core.realtime.RealtimeBus;
+import com.kingsrook.qqq.backend.core.realtime.RealtimeMessage;
+
+/*******************************************************************************
+ ** Identifier-only hints, published after successful commit.
+ *******************************************************************************/
+public class CollaborationRealtime implements RecordChangeListenerInterface
+{
+   private static final QLogger LOG = QLogger.getLogger(CollaborationRealtime.class);
+
+   /*******************************************************************************
+    ** Only records with client invalidation contracts.
+    *******************************************************************************/
+   @Override
+   public boolean appliesTo(String table, RecordChangeType type)
+   {
+      return (java.util.List.of(CollaborationTables.COMMENT, CollaborationTables.ATTACHMENT, CollaborationTables.RECORD_TAG, CollaborationTables.TASK).contains(table));
+   }
+
+   /*******************************************************************************
+    ** Capture immutable payloads while the write's session and transaction are active.
+    *******************************************************************************/
+   @Override
+   public void onRecordsChanged(RecordChangeEvent change) throws QException
+   {
+      var instance = QContext.getQInstance();
+      for(int index = 0; index < change.getRecords().size(); index++)
+      {
+         var row = new com.kingsrook.qqq.backend.core.model.data.QRecord(change.getRecords().get(index));
+         if(change.getOldRecords() != null && index < change.getOldRecords().size() && change.getOldRecords().get(index) != null)
+         {
+            var complete = new com.kingsrook.qqq.backend.core.model.data.QRecord(change.getOldRecords().get(index));
+            complete.getValues().putAll(row.getValues());
+            row = complete;
+         }
+         String table = row.getValueString("tableName");
+         String id = row.getValueString("recordId");
+         if(table == null || id == null)
+         {
+            continue;
+         }
+         String event = switch(change.getTableName())
+         {
+            case CollaborationTables.COMMENT -> change.getType() == RecordChangeType.DELETE || row.getValue("deletedAt") != null
+               ? "comment.deleted" : change.getType() == RecordChangeType.INSERT ? "comment.added" : "comment.updated";
+            case CollaborationTables.ATTACHMENT -> "attachment.changed";
+            case CollaborationTables.RECORD_TAG -> "tags.changed";
+            default -> "task.changed";
+         };
+         var message = new RealtimeMessage().withChannel("record:" + table + ":" + id).withEvent(event)
+            .withData(Map.of("table", table, "pk", id, "id", row.getValue("id")));
+         Runnable publish = () ->
+         {
+            try
+            {
+               RealtimeBus.get(instance).publish(message);
+            }
+            catch(Exception e)
+            {
+               LOG.warn("Could not publish collaboration invalidation", e);
+            }
+         };
+         if(change.getTransaction() == null)
+         {
+            publish.run();
+         }
+         else
+         {
+            change.getTransaction().addAfterCommitCallback(publish);
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/CollaborationRecords.java

@@ -115,6 +115,56 @@ public final class CollaborationRecords
       check(new DeleteAction().execute(input).getRecordsWithErrors());
    }
 
+   /*******************************************************************************
+    ** Trusted after-delete reads must see children whose parent no longer exists.
+    *******************************************************************************/
+   public static List<QRecord> cleanupQuery(String table, QQueryFilter filter) throws QException
+   {
+      QueryInput input = new QueryInput(table).withFilter(filter).withShouldFetchHeavyFields(true);
+      input.setTableMetaData(cleanupMetadata(table));
+      input.withPermissionBypass("Core after-commit parent cleanup.");
+      return (new QueryAction().execute(input).getRecords());
+   }
+
+   /*******************************************************************************
+    ** Delete only identifiers selected by a trusted cleanup provider.
+    *******************************************************************************/
+   public static void cleanupDelete(String table, Serializable id) throws QException
+   {
+      DeleteInput input = new DeleteInput(table).withPrimaryKeys(List.of(id));
+      input.setTableMetaData(cleanupMetadata(table));
+      input.withPermissionBypass("Core after-commit parent cleanup.");
+      check(new DeleteAction().execute(input).getRecordsWithErrors());
+   }
+
+   /*******************************************************************************
+    ** Private metadata for derived cleanup, never installed on the instance.
+    *******************************************************************************/
+   public static QTableMetaData cleanupMetadata(String table)
+   {
+      QTableMetaData metadata = serviceMetadata(table);
+      metadata.getSupplementalMetaData().remove(com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordReferenceTableMetaData.NAME);
+      metadata.setRecordSecurityLocks(null);
+      return (metadata);
+   }
+
+   /*******************************************************************************
+    ** A verified share recipient may acknowledge a share without reading its parent.
+    *******************************************************************************/
+   public static void acknowledgeShare(Integer id, java.time.Instant openedAt) throws QException
+   {
+      QRecord row = WorkSupport.row(com.kingsrook.qbits.collaboration.model.CollaborationTables.SHARE, id);
+      if(!PersonalRecords.currentUserId().equals(row.getValueString("toUserId")))
+      {
+         throw (new com.kingsrook.qqq.backend.core.exceptions.QNotFoundException("Not found"));
+      }
+      UpdateInput input = new UpdateInput(com.kingsrook.qbits.collaboration.model.CollaborationTables.SHARE)
+         .withRecords(List.of(new QRecord().withValue("id", id).withValue("openedAt", openedAt))).withTransaction(QContext.getQBackendTransaction());
+      input.setTableMetaData(cleanupMetadata(com.kingsrook.qbits.collaboration.model.CollaborationTables.SHARE));
+      input.withPermissionBypass("Verified share recipient acknowledges receipt; no parent data is changed.");
+      check(new UpdateAction().execute(input).getRecords());
+   }
+
    /*******************************************************************************
     ** Access-request services enforce requester/approver authority explicitly.
     ** Bypass only that owner lock on a private metadata clone, retaining the caller
@@ -122,7 +172,11 @@ public final class CollaborationRecords
     *******************************************************************************/
    private static QTableMetaData serviceMetadata(String table)
    {
-      QTableMetaData metadata = QContext.getQInstance().getTable(table).clone().withCustomizers(null);
+      QTableMetaData metadata = QContext.getQInstance().getTable(table).clone();
+      if(!table.equals(com.kingsrook.qbits.collaboration.model.CollaborationTables.FEATURE_SETTING))
+      {
+         metadata.withCustomizers(null);
+      }
       if(table.equals(com.kingsrook.qbits.collaboration.model.CollaborationTables.ACCESS_REQUEST))
       {
          metadata.setRecordSecurityLocks(null);

src/main/java/com/kingsrook/qbits/collaboration/CollaborationSchema.java

@@ -60,6 +60,13 @@ public final class CollaborationSchema
             columns.add("   " + field.getBackendName() + " " + type + (field.getName().equals("parentDeleted") ? " DEFAULT FALSE" : "") + (Boolean.TRUE.equals(field.getIsRequired()) ? " NOT NULL" : ""));
          }
          statements.add("CREATE TABLE IF NOT EXISTS " + table.getName() + " (\n" + String.join(",\n", columns) + "\n)");
+         for(QFieldMetaData field : table.getFields().values())
+         {
+            if(field.getName().startsWith("lockKey_"))
+            {
+               statements.add("ALTER TABLE " + table.getName() + " ADD COLUMN IF NOT EXISTS " + field.getBackendName() + " " + sqlType(field));
+            }
+         }
          int index = 0;
          for(UniqueKey key : table.getUniqueKeys() == null ? List.<UniqueKey>of() : table.getUniqueKeys())
          {

src/main/java/com/kingsrook/qbits/collaboration/CollaborationSummaryProvider.java

@@ -0,0 +1,101 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.actions.collaboration.RecordFeatureSummaryProviderInterface;
+import com.kingsrook.qqq.backend.core.actions.collaboration.RecordFeaturesResolver;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeature;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeatureSummary;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordReference;
+
+/*******************************************************************************
+ ** Caller-scoped values for the core record features endpoint.
+ *******************************************************************************/
+public class CollaborationSummaryProvider implements RecordFeatureSummaryProviderInterface
+{
+   /*******************************************************************************
+    ** Core has already checked the parent; omit values for disabled features.
+    *******************************************************************************/
+   @Override
+   public void contribute(RecordReference ref, QRecord parent, RecordFeatureSummary summary) throws QException
+   {
+      var features = RecordFeaturesResolver.resolve(QContext.getQInstance(), QContext.getQInstance().getTable(ref.tableName()));
+      String id = parent.getValueString(QContext.getQInstance().getTable(ref.tableName()).getPrimaryKeyField());
+      String user = PersonalRecords.currentUserId();
+      if(features.isEnabled(RecordFeature.FAVORITES))
+      {
+         summary.setIsFavorite(!CollaborationRecords.query(CollaborationTables.FAVORITE, new QQueryFilter()
+            .withCriteria("targetType", QCriteriaOperator.EQUALS, "RECORD").withCriteria("targetName", QCriteriaOperator.EQUALS, ref.tableName())
+            .withCriteria("recordId", QCriteriaOperator.EQUALS, id).withCriteria("userId", QCriteriaOperator.EQUALS, user)).isEmpty());
+      }
+      if(features.isEnabled(RecordFeature.FOLLOW))
+      {
+         var rows = CollaborationRecords.query(CollaborationTables.FOLLOW, CollaborationRecords.parent(ref.tableName(), id));
+         summary.setIsFollowing(rows.stream().anyMatch(row -> user.equals(row.getValueString("userId"))));
+         summary.getCounts().put("followers", rows.size());
+      }
+      if(features.isEnabled(RecordFeature.COMMENTS))
+      {
+         summary.getCounts().put("openComments", CollaborationRecords.query(CollaborationTables.COMMENT, CollaborationRecords.parent(ref.tableName(), id)
+            .withCriteria("deletedAt", QCriteriaOperator.IS_BLANK).withCriteria("resolvedAt", QCriteriaOperator.IS_BLANK)).size());
+      }
+      if(features.isEnabled(RecordFeature.ATTACHMENTS))
+      {
+         summary.getCounts().put("attachments", CollaborationRecords.query(CollaborationTables.ATTACHMENT, CollaborationRecords.parent(ref.tableName(), id)).size());
+      }
+      if(features.isEnabled(RecordFeature.TAGS))
+      {
+         summary.getCounts().put("tags", CollaborationRecords.query(CollaborationTables.RECORD_TAG, CollaborationRecords.parent(ref.tableName(), id)).size());
+      }
+      if(features.isEnabled(RecordFeature.TASKS))
+      {
+         summary.getCounts().put("openTasks", CollaborationRecords.query(CollaborationTables.TASK, CollaborationRecords.parent(ref.tableName(), id)
+            .withCriteria("status", QCriteriaOperator.EQUALS, "OPEN")).size());
+      }
+      if(features.isEnabled(RecordFeature.ASSIGNMENT))
+      {
+         var rows = CollaborationRecords.query(CollaborationTables.RECORD_ASSIGNMENT, CollaborationRecords.parent(ref.tableName(), id));
+         if(!rows.isEmpty())
+         {
+            summary.withOwner(rows.getFirst().getValueString("ownerUserId")).withAssignee(rows.getFirst().getValueString("assigneeUserId"));
+         }
+         if(features.getOwnership() != null)
+         {
+            var ownership = features.getOwnership();
+            if(ownership.getOwnerFieldName() != null)
+            {
+               summary.setOwner(parent.getValueString(ownership.getOwnerFieldName()));
+            }
+            if(ownership.getAssigneeFieldName() != null)
+            {
+               summary.setAssignee(parent.getValueString(ownership.getAssigneeFieldName()));
+            }
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/CoreCollaboration.java

@@ -0,0 +1,105 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.actions.collaboration.RecordReferenceSecurityHelper;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeature;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeaturesMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordReferenceSecurityConfig;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordReferenceTableMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.security.RecordSecurityLock;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Install the qbit implementations of core collaboration contracts.
+ *******************************************************************************/
+public final class CoreCollaboration
+{
+   private static final Map<String, RecordFeature> REFERENCES = Map.ofEntries(
+      Map.entry(CollaborationTables.ATTACHMENT, RecordFeature.ATTACHMENTS),
+      Map.entry(CollaborationTables.RECORD_TAG, RecordFeature.TAGS),
+      Map.entry(CollaborationTables.COMMENT, RecordFeature.COMMENTS),
+      Map.entry(CollaborationTables.COMMENT_REVISION, RecordFeature.COMMENTS),
+      Map.entry(CollaborationTables.MENTION, RecordFeature.COMMENTS),
+      Map.entry(CollaborationTables.FOLLOW, RecordFeature.FOLLOW),
+      Map.entry(CollaborationTables.FOLLOW_DIGEST, RecordFeature.FOLLOW),
+      Map.entry(CollaborationTables.ACTIVITY, RecordFeature.TIMELINE),
+      Map.entry(CollaborationTables.SHARE, RecordFeature.SHARING),
+      Map.entry(CollaborationTables.TASK, RecordFeature.TASKS),
+      Map.entry(CollaborationTables.RECORD_ASSIGNMENT, RecordFeature.ASSIGNMENT));
+
+   /*******************************************************************************
+    ** Static installer.
+    *******************************************************************************/
+   private CoreCollaboration()
+   {
+   }
+
+   /*******************************************************************************
+    ** Preserve other providers installed by the host.
+    *******************************************************************************/
+   public static void install(QInstance instance, CollaborationQBitConfig config)
+   {
+      config.applyFeatures(instance);
+      var features = RecordFeaturesMetaData.ofOrWithNew(instance);
+      features.withOverrideProvider(new QCodeReference(FeatureSettingsProvider.class));
+      features.getRuntimeProviders().add(new QCodeReference(com.kingsrook.qbits.collaboration.tags.TagsMetaDataProvider.class));
+      features.getSummaryProviders().add(new QCodeReference(CollaborationSummaryProvider.class));
+      var security = RecordReferenceSecurityConfig.ofOrWithNew(instance).withMirroredSecurityKeyTypes(config.getMirroredSecurityKeyTypes());
+      security.getCleanupProviders().add(new QCodeReference(CollaborationCleanup.class));
+      RecordReferenceSecurityHelper.register(instance);
+   }
+
+   /*******************************************************************************
+    ** Children already carry denormalized references in this qbit schema.
+    *******************************************************************************/
+   public static void reference(QTableMetaData table, CollaborationQBitConfig config)
+   {
+      RecordFeature feature = REFERENCES.get(table.getName());
+      if(feature == null)
+      {
+         return;
+      }
+      String author = switch(table.getName())
+      {
+         case CollaborationTables.ATTACHMENT -> "createdByUserId";
+         case CollaborationTables.COMMENT -> "authorUserId";
+         case CollaborationTables.SHARE -> "fromUserId";
+         default -> null;
+      };
+      table.withSupplementalMetaData(new RecordReferenceTableMetaData().withTableNameField("tableName").withRecordIdField("recordId")
+         .withFeature(feature).withAuthorField(author).withMirroredLocks(true));
+      for(String keyType : config.getMirroredSecurityKeyTypes())
+      {
+         String field = RecordReferenceSecurityConfig.lockFieldName(keyType);
+         table.withField(new QFieldMetaData(field, QFieldType.STRING).withLabel(keyType).withIsEditable(false));
+         table.withRecordSecurityLock(new RecordSecurityLock().withFieldName(field).withSecurityKeyType(keyType)
+            .withNullValueBehavior(RecordSecurityLock.NullValueBehavior.ALLOW));
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/FeatureSettingsCustomizer.java

@@ -0,0 +1,98 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.util.List;
+import java.util.Optional;
+import com.kingsrook.qqq.backend.core.actions.QBackendTransaction;
+import com.kingsrook.qqq.backend.core.actions.collaboration.RuntimeMetaDataOverlay;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizerInterface;
+import com.kingsrook.qqq.backend.core.context.CapturedContext;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Publish committed policy changes through the core overlay.
+ *******************************************************************************/
+public class FeatureSettingsCustomizer implements TableCustomizerInterface
+{
+   /*******************************************************************************
+    ** Refresh after successful insert.
+    *******************************************************************************/
+   @Override
+   public List<QRecord> postInsert(InsertInput input, List<QRecord> records) throws QException
+   {
+      refresh(input.getTransaction());
+      return (records);
+   }
+
+   /*******************************************************************************
+    ** Refresh after successful update.
+    *******************************************************************************/
+   @Override
+   public List<QRecord> postUpdate(UpdateInput input, List<QRecord> records, Optional<List<QRecord>> oldRecords) throws QException
+   {
+      refresh(input.getTransaction());
+      return (records);
+   }
+
+   /*******************************************************************************
+    ** Refresh after successful delete.
+    *******************************************************************************/
+   @Override
+   public List<QRecord> postDelete(DeleteInput input, List<QRecord> records) throws QException
+   {
+      refresh(input.getTransaction());
+      return (records);
+   }
+
+   /*******************************************************************************
+    ** Never retain the completed transaction in a refresh callback.
+    *******************************************************************************/
+   private void refresh(QBackendTransaction transaction) throws QException
+   {
+      var instance = QContext.getQInstance();
+      if(transaction == null)
+      {
+         RuntimeMetaDataOverlay.refresh(instance);
+      }
+      else
+      {
+         var context = new CapturedContext(instance, QContext.getQSession());
+         transaction.addAfterCommitCallback(() ->
+         {
+            try
+            {
+               QContext.withTemporaryContext(context, () -> RuntimeMetaDataOverlay.refresh(instance));
+            }
+            catch(QException e)
+            {
+               throw (new IllegalStateException("Could not refresh collaboration policy", e));
+            }
+         });
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/FeatureSettingsProvider.java

@@ -0,0 +1,75 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.actions.collaboration.RecordFeatureOverrideProviderInterface;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.FeaturePermissionMode;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeature;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeatureOverride;
+
+/*******************************************************************************
+ ** Read persisted feature policy during core overlay refresh.
+ *******************************************************************************/
+public class FeatureSettingsProvider implements RecordFeatureOverrideProviderInterface
+{
+   /*******************************************************************************
+    ** Malformed policy rejects the contribution, retaining the last core snapshot.
+    *******************************************************************************/
+   @Override
+   public List<RecordFeatureOverride> getOverrides(QInstance instance) throws QException
+   {
+      List<RecordFeatureOverride> result = new ArrayList<>();
+      for(var row : CollaborationRecords.query(CollaborationTables.FEATURE_SETTING, new QQueryFilter()))
+      {
+         try
+         {
+            var override = new RecordFeatureOverride().withScopeType(RecordFeatureOverride.ScopeType.valueOf(row.getValueString("scopeType")))
+               .withScopeName(row.getValueString("scopeName")).withFeature(RecordFeature.valueOf(row.getValueString("feature")))
+               .withEnabled(row.getValueBoolean("enabled"));
+            if(row.getValueString("permissionMode") != null)
+            {
+               override.withPermissionMode(FeaturePermissionMode.valueOf(row.getValueString("permissionMode")));
+            }
+            if(row.getValueString("settings") != null && !row.getValueString("settings").isBlank())
+            {
+               override.withSettings(new ObjectMapper().readValue(row.getValueString("settings"), new TypeReference<Map<String, Serializable>>() {}));
+            }
+            result.add(override);
+         }
+         catch(Exception e)
+         {
+            throw (new QException("Invalid collaboration feature setting", e));
+         }
+      }
+      return (result);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/RecordCursor.java

@@ -24,6 +24,7 @@ package com.kingsrook.qbits.collaboration;
 import java.nio.charset.StandardCharsets;
 import java.time.Instant;
 import java.util.Base64;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
@@ -57,7 +58,7 @@ public record RecordCursor(Instant at, String kind, Long id)
       }
       catch(RuntimeException e)
       {
-         throw (new QException("Invalid cursor", e));
+         throw (new QBadRequestException("Invalid cursor", e));
       }
    }
 

src/main/java/com/kingsrook/qbits/collaboration/TargetResolver.java

@@ -38,7 +38,9 @@ import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType
 import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
 import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
 import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
 import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
 import com.kingsrook.qqq.backend.core.exceptions.QValueException;
 import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
@@ -81,7 +83,7 @@ public final class TargetResolver
       if(type == null || !TYPES.contains(type) || name == null || name.isBlank()
          || ("RECORD".equals(type) ? id == null || id.isBlank() : id != null))
       {
-         throw (new QException("Invalid target"));
+         throw (new QBadRequestException("Invalid target"));
       }
       if("RECORD".equals(type))
       {
@@ -94,7 +96,7 @@ public final class TargetResolver
             }
             catch(QValueException expected)
             {
-               throw (new QException("Not found"));
+               throw (new QNotFoundException("Not found"));
             }
          }
       }
@@ -122,7 +124,7 @@ public final class TargetResolver
       }
       if(!entry.available())
       {
-         throw (new QException("Not found"));
+         throw (new QNotFoundException("Not found"));
       }
       return (entry);
    }

src/main/java/com/kingsrook/qbits/collaboration/WorkCleanup.java

@@ -95,7 +95,7 @@ public class WorkCleanup implements RecordChangeListenerInterface
       {
          while(true)
          {
-            List<QRecord> rows = CollaborationRecords.query(child, new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table)
+            List<QRecord> rows = CollaborationRecords.cleanupQuery(child, new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table)
                .withCriteria("recordId", QCriteriaOperator.IN, ids.stream().map(Object::toString).toList()).withLimit(200));
             if(rows.isEmpty())
             {
@@ -103,7 +103,7 @@ public class WorkCleanup implements RecordChangeListenerInterface
             }
             for(QRecord row : rows)
             {
-               CollaborationRecords.delete(child, row.getValue("id"));
+               CollaborationRecords.cleanupDelete(child, row.getValue("id"));
             }
          }
       }

src/main/java/com/kingsrook/qbits/collaboration/WorkSupport.java

@@ -24,7 +24,7 @@ package com.kingsrook.qbits.collaboration;
 import java.io.Serializable;
 import java.util.List;
 import com.kingsrook.qbits.collaboration.people.PeopleService;
-import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qbits.collaboration.security.CollaborationRecordAccessChecker;
 import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
@@ -77,9 +77,9 @@ public final class WorkSupport
    public static void requireReader(String user, String table, Serializable id) throws QException
    {
       if(user != null && (user.isBlank() || (!user.equals(PersonalRecords.currentUserId())
-         && !new OtherUserAccess().canRead(user, table, id).orElse(false))))
+         && !new CollaborationRecordAccessChecker().canRead(user, table, id).orElse(false))))
       {
-         throw (new QException(new PeopleService().displayName(user) + " can't open this record."));
+         throw (new com.kingsrook.qqq.backend.core.exceptions.QBadRequestException(new PeopleService().displayName(user) + " can't open this record."));
       }
    }
 
@@ -90,7 +90,7 @@ public final class WorkSupport
    {
       if((required && (value == null || value.isBlank())) || (value != null && value.length() > max))
       {
-         throw (new QException("Text must contain " + (required ? "1" : "0") + " to " + max + " characters."));
+         throw (new com.kingsrook.qqq.backend.core.exceptions.QBadRequestException("Text must contain " + (required ? "1" : "0") + " to " + max + " characters."));
       }
    }
 }

src/main/java/com/kingsrook/qbits/collaboration/api/ApplyTagsSpec.java

@@ -0,0 +1,86 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationTagApplyRequestV1;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationTagListV1;
+import com.kingsrook.qbits.collaboration.tags.TagsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+
+/*******************************************************************************
+ ** Add and remove record tags.
+ *******************************************************************************/
+public class ApplyTagsSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.PUT, "/records/{table}/{pk}/tags", "Add and remove record tags"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationTagListV1");
+   }
+
+   /*******************************************************************************
+    ** Name the versioned request body.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationTagApplyRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationTagApplyRequestV1.class);
+      new TagsService().apply(table(input), pk(input), ids(body.add()), ids(body.remove()));
+      return (new CollaborationTagListV1(new TagsService().tagsFor(table(input), pk(input)).stream().map(CollaborationViews::tag).toList(), null));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/CollaborationApi.java

@@ -0,0 +1,100 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.middleware.javalin.specs.extensions.MiddlewareSpecExtension;
+import com.kingsrook.qqq.middleware.javalin.specs.extensions.MiddlewareSpecExtensionsMetaData;
+
+
+/*******************************************************************************
+ ** Register the collaboration UI API extension on a host instance.
+ *******************************************************************************/
+public final class CollaborationApi
+{
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private CollaborationApi()
+   {
+   }
+
+   /*******************************************************************************
+    ** Install the extension; the producer calls this when uiApi is enabled.
+    *******************************************************************************/
+   public static void register(QInstance instance)
+   {
+      MiddlewareSpecExtensionsMetaData.ofOrWithNew(instance).withExtension(extension());
+   }
+
+   /*******************************************************************************
+    ** The standalone descriptor used by registration and contract generation.
+    *******************************************************************************/
+   public static MiddlewareSpecExtension extension()
+   {
+      return (new MiddlewareSpecExtension().withName("collaboration").withSemanticVersion("1.0.0")
+         .withDescription("Record collaboration: favorites, recents, attachments, tags, conversations, following, timeline and people")
+         .withSpec(ListFavoritesSpec.class)
+         .withSpec(StarFavoriteSpec.class)
+         .withSpec(UnstarFavoriteSpec.class)
+         .withSpec(RecordRecentSpec.class)
+         .withSpec(OrderFavoritesSpec.class)
+         .withSpec(ListRecentsSpec.class)
+         .withSpec(ListAttachmentsSpec.class)
+         .withSpec(DownloadAttachmentSpec.class)
+         .withSpec(PreviewAttachmentSpec.class)
+         .withSpec(PatchAttachmentSpec.class)
+         .withSpec(DeleteAttachmentSpec.class)
+         .withSpec(ListTagsSpec.class)
+         .withSpec(CreateTagSpec.class)
+         .withSpec(ListRecordTagsSpec.class)
+         .withSpec(ApplyTagsSpec.class)
+         .withSpec(ListCommentsSpec.class)
+         .withSpec(PostCommentSpec.class)
+         .withSpec(EditCommentSpec.class)
+         .withSpec(DeleteCommentSpec.class)
+         .withSpec(ResolveCommentSpec.class)
+         .withSpec(ReopenCommentSpec.class)
+         .withSpec(CommentHistorySpec.class)
+         .withSpec(MentionCandidatesSpec.class)
+         .withSpec(GetFollowSpec.class)
+         .withSpec(PutFollowSpec.class)
+         .withSpec(DeleteFollowSpec.class)
+         .withSpec(ListFollowersSpec.class)
+         .withSpec(GetTimelineSpec.class)
+         .withSpec(ListPeopleSpec.class)
+         .withSpec(GetPersonSpec.class)
+         .withSpec(GetRecordLinkSpec.class)
+         .withSpec(PreviewSharesSpec.class)
+         .withSpec(CreateSharesSpec.class)
+         .withSpec(CreateAccessRequestSpec.class)
+         .withSpec(ListMyAccessRequestsSpec.class)
+         .withSpec(ListTasksSpec.class)
+         .withSpec(CreateTaskSpec.class)
+         .withSpec(PatchTaskSpec.class)
+         .withSpec(ListMyTasksSpec.class)
+         .withSpec(PutAssignmentSpec.class)
+         .withSpec(GetMyWorkSpec.class)
+         .withSpec(UploadAttachmentSpec.class));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/CollaborationJsonSpec.java

@@ -0,0 +1,396 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import java.util.stream.Collectors;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.MapperFeature;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.cfg.CoercionAction;
+import com.fasterxml.jackson.databind.cfg.CoercionInputShape;
+import com.fasterxml.jackson.databind.json.JsonMapper;
+import com.fasterxml.jackson.databind.type.LogicalType;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationMutationResultV1;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicResponse;
+import com.kingsrook.qqq.middleware.javalin.specs.extensions.AbstractJsonEndpointSpec;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.In;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+import com.kingsrook.qqq.openapi.model.Type;
+import io.javalin.http.Context;
+import io.javalin.http.HttpStatus;
+
+
+/*******************************************************************************
+ ** Common JSON transport declarations and input validation; services own authorization.
+ *******************************************************************************/
+abstract class CollaborationJsonSpec extends AbstractJsonEndpointSpec
+{
+   private static final ObjectMapper MAPPER = mapper();
+
+   /*******************************************************************************
+    ** Jackson's scalar-coercion flag alone still permits numbers as text.
+    *******************************************************************************/
+   private static ObjectMapper mapper()
+   {
+      ObjectMapper mapper = JsonMapper.builder().disable(MapperFeature.ALLOW_COERCION_OF_SCALARS)
+         .disable(DeserializationFeature.ACCEPT_FLOAT_AS_INT).build();
+      mapper.coercionConfigFor(LogicalType.Textual)
+         .setCoercion(CoercionInputShape.Integer, CoercionAction.Fail)
+         .setCoercion(CoercionInputShape.Float, CoercionAction.Fail)
+         .setCoercion(CoercionInputShape.Boolean, CoercionAction.Fail);
+      return (mapper);
+   }
+
+   /*******************************************************************************
+    ** Check record visibility before decoding a body or paging parameters.
+    *******************************************************************************/
+   @Override
+   public JsonInput buildInput(Context context) throws Exception
+   {
+      if(context.pathParamMap().containsKey("table"))
+      {
+         ParentRecordAccess.requireVisibleParent(context.pathParam("table"), context.pathParam("pk"));
+      }
+      return (super.buildInput(context));
+   }
+
+   /*******************************************************************************
+    ** Extension-relative operation with semantic client documentation.
+    *******************************************************************************/
+   static BasicOperation operation(HttpMethod method, String path, String summary)
+   {
+      return (new BasicOperation().withHttpMethod(method).withPath("/qbit/collaboration" + path)
+         .withShortSummary(summary).withLongDescription(summary + ". Uses the signed-in caller's permissions and record visibility."));
+   }
+
+   /*******************************************************************************
+    ** Declare the framework's standard error bodies without replacing its mapping.
+    *******************************************************************************/
+   @Override
+   public List<BasicResponse> defineAdditionalBasicResponses()
+   {
+      return (errors());
+   }
+
+   /*******************************************************************************
+    ** Shared error contract, including the multipart operation.
+    *******************************************************************************/
+   static List<BasicResponse> errors()
+   {
+      return (List.of(new BasicResponse(HttpStatus.BAD_REQUEST, "Invalid input", "CollaborationErrorV1"),
+         new BasicResponse(HttpStatus.UNAUTHORIZED, "Sign in required", "CollaborationErrorV1"),
+         new BasicResponse(HttpStatus.FORBIDDEN, "Permission denied", "CollaborationErrorV1"),
+         new BasicResponse(HttpStatus.NOT_FOUND, "Not found (including invisible parents)", "CollaborationErrorV1")));
+   }
+
+   /*******************************************************************************
+    ** Path parameters and explicitly supported query parameters.
+    *******************************************************************************/
+   protected List<Parameter> parameters(String... queries)
+   {
+      return (parametersFor(defineBasicOperation().getPath(), queries));
+   }
+
+   /*******************************************************************************
+    ** Parameter descriptions are shared with multipart upload.
+    *******************************************************************************/
+   static List<Parameter> parametersFor(String path, String... queries)
+   {
+      List<Parameter> result = new ArrayList<>();
+      Matcher matcher = Pattern.compile("\\{([^}]+)}").matcher(path);
+      while(matcher.find())
+      {
+         String name = matcher.group(1);
+         result.add(parameter(name, In.PATH, true));
+      }
+      for(String query : queries)
+      {
+         result.add(parameter(query.replace("!", ""), In.QUERY, query.endsWith("!")));
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Semantic hints for clients and command-line help.
+    *******************************************************************************/
+   private static Parameter parameter(String name, In location, boolean required)
+   {
+      String description = switch(name)
+      {
+         case "table" -> "Parent table metadata name.";
+         case "pk" -> "Parent record primary key.";
+         case "id" -> "Collaboration object identifier.";
+         case "userId" -> "Stable directory user identity.";
+         case "limit" -> "Maximum items to return, from 1 to 100; default 20.";
+         case "cursor" -> "Opaque nextCursor returned by the previous page; omit for the first page.";
+         case "before" -> "Timeline continuation token; alias for cursor. Supply only one.";
+         case "includeDone" -> "Include completed and cancelled tasks; default false.";
+         case "status" -> "Task status: OPEN (default), DONE or CANCELLED.";
+         case "types" -> "Comma-separated AUDIT, ACTIVITY or activity type names (for example COMMENTED).";
+         case "q" -> "Text to search in display names or vocabulary.";
+         default -> name;
+      };
+      return (new Parameter().withName(name).withIn(location).withRequired(required).withDescription(description)
+         .withSchema(new Schema().withType(name.equals("limit") ? Type.INTEGER : name.equals("includeDone") ? Type.BOOLEAN : Type.STRING)));
+   }
+
+   /*******************************************************************************
+    ** Reject malformed types instead of silently coercing client values.
+    *******************************************************************************/
+   protected static <T> T body(JsonInput input, Class<T> type) throws QBadRequestException
+   {
+      try
+      {
+         if(input.getBody() == null)
+         {
+            throw (new IllegalArgumentException("Object body required"));
+         }
+         return (MAPPER.convertValue(input.getBody(), type));
+      }
+      catch(IllegalArgumentException e)
+      {
+         throw (new QBadRequestException("Invalid " + type.getSimpleName() + " body: check the property names and types."));
+      }
+   }
+
+   /*******************************************************************************
+    ** Validate the shared page bound.
+    *******************************************************************************/
+   protected static int limit(JsonInput input) throws QBadRequestException
+   {
+      Integer limit = input.getQueryParamInteger("limit");
+      if(limit == null)
+      {
+         return (20);
+      }
+      if(limit < 1 || limit > 100)
+      {
+         throw (new QBadRequestException("Limit must be between 1 and 100"));
+      }
+      return (limit);
+   }
+
+   /*******************************************************************************
+    ** Page complete, permission-filtered service lists; recheck on every request.
+    ** These cursors are offsets, not a snapshot across concurrent mutations.
+    *******************************************************************************/
+   protected static <T> Page<T> page(JsonInput input, List<T> values) throws QBadRequestException
+   {
+      int limit = limit(input);
+      int offset = 0;
+      String scope = input.getSpec().defineBasicOperation().getPath() + input.getPathParams().toString()
+         + ":" + input.getQueryParam("table") + ":" + input.getQueryParam("pk") + ":" + input.getQueryParam("q");
+      String prefix = "1:" + Integer.toHexString(scope.hashCode()) + ":";
+      String cursor = input.getQueryParam("cursor");
+      if(cursor != null)
+      {
+         try
+         {
+            String decoded = new String(Base64.getUrlDecoder().decode(cursor), StandardCharsets.UTF_8);
+            if(!decoded.startsWith(prefix))
+            {
+               throw (new IllegalArgumentException("Wrong cursor scope"));
+            }
+            offset = Integer.parseInt(decoded.substring(prefix.length()));
+            if(offset < 0)
+            {
+               throw (new IllegalArgumentException("Negative offset"));
+            }
+         }
+         catch(IllegalArgumentException e)
+         {
+            throw (new QBadRequestException("Invalid cursor"));
+         }
+      }
+      int start = Math.min(offset, values.size());
+      int end = start + Math.min(limit, values.size() - start);
+      String next = end < values.size() ? Base64.getUrlEncoder().withoutPadding().encodeToString((prefix + end).getBytes(StandardCharsets.UTF_8)) : null;
+      return (new Page<>(values.subList(start, end), next));
+   }
+
+   /*******************************************************************************
+    ** Internal page shape before projecting the specific wire type.
+    *******************************************************************************/
+   protected record Page<T>(List<T> items, String nextCursor)
+   {
+   }
+
+   /*******************************************************************************
+    ** A required nonblank string.
+    *******************************************************************************/
+   protected static String required(String value, String name) throws QBadRequestException
+   {
+      if(value == null || value.isBlank())
+      {
+         throw (new QBadRequestException(name + " is required"));
+      }
+      return (value);
+   }
+
+   /*******************************************************************************
+    ** Parent table name.
+    *******************************************************************************/
+   protected static String table(JsonInput input)
+   {
+      return (input.getPathParam("table"));
+   }
+
+   /*******************************************************************************
+    ** Parent key remains a string until the service canonicalizes its field type.
+    *******************************************************************************/
+   protected static String pk(JsonInput input)
+   {
+      return (input.getPathParam("pk"));
+   }
+
+   /*******************************************************************************
+    ** Collaboration tables use positive integer identifiers.
+    *******************************************************************************/
+   protected static Integer id(JsonInput input) throws QBadRequestException
+   {
+      return (positiveId(input.getPathParam("id")));
+   }
+
+   /*******************************************************************************
+    ** Strict identifier parsing, also used for folder-map keys.
+    *******************************************************************************/
+   private static Integer positiveId(String value) throws QBadRequestException
+   {
+      try
+      {
+         int id = Integer.parseInt(value);
+         if(id < 1)
+         {
+            throw (new NumberFormatException());
+         }
+         return (id);
+      }
+      catch(NumberFormatException e)
+      {
+         throw (new QBadRequestException("An identifier must be a positive integer"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Optional add/remove lists may be empty, but never contain null identifiers.
+    *******************************************************************************/
+   protected static List<Integer> ids(List<Integer> values) throws QBadRequestException
+   {
+      if(values == null)
+      {
+         return (List.of());
+      }
+      if(values.stream().anyMatch(id -> id == null || id < 1))
+      {
+         throw (new QBadRequestException("Tag identifiers must be positive integers"));
+      }
+      return (values);
+   }
+
+   /*******************************************************************************
+    ** Convert JSON object keys without trusting arbitrary numeric coercion.
+    *******************************************************************************/
+   protected static Map<Integer, String> folders(Map<String, String> values) throws QBadRequestException
+   {
+      Map<Integer, String> result = new LinkedHashMap<>();
+      if(values != null)
+      {
+         for(Map.Entry<String, String> entry : values.entrySet())
+         {
+            result.put(positiveId(entry.getKey()), entry.getValue());
+         }
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Preserve the timeline's before name and the common cursor convention.
+    *******************************************************************************/
+   protected static String timelineCursor(JsonInput input) throws QBadRequestException
+   {
+      if(input.getQueryParam("before") != null && input.getQueryParam("cursor") != null)
+      {
+         throw (new QBadRequestException("Supply before or cursor, not both"));
+      }
+      return (input.getQueryParam("before") == null ? input.getQueryParam("cursor") : input.getQueryParam("before"));
+   }
+
+   /*******************************************************************************
+    ** Timeline accepts source names or collaboration activity names.
+    *******************************************************************************/
+   protected static Set<String> types(JsonInput input)
+   {
+      String types = input.getQueryParam("types");
+      return (types == null || types.isBlank() ? Set.of() : Arrays.stream(types.split(",")).map(String::strip).collect(Collectors.toSet()));
+   }
+
+   /*******************************************************************************
+    ** Consistent acknowledgement for operations with no service return value.
+    *******************************************************************************/
+   protected static CollaborationMutationResultV1 success()
+   {
+      return (new CollaborationMutationResultV1(true));
+   }
+
+   /*******************************************************************************
+    ** Parse a nullable ISO-8601 timestamp.
+    *******************************************************************************/
+   protected static java.time.Instant instant(String value) throws QBadRequestException
+   {
+      try
+      {
+         return (value == null ? null : java.time.Instant.parse(value));
+      }
+      catch(java.time.format.DateTimeParseException e)
+      {
+         throw (new QBadRequestException("Expected an ISO-8601 timestamp"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Recipient lists are bounded and contain only nonblank identities.
+    *******************************************************************************/
+   protected static List<String> recipients(List<String> values) throws QBadRequestException
+   {
+      if(values == null || values.isEmpty() || values.size() > 25 || values.stream().anyMatch(value -> value == null || value.isBlank()))
+      {
+         throw (new QBadRequestException("Choose 1 to 25 recipients"));
+      }
+      return (values);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/CollaborationSchemas.java

@@ -0,0 +1,717 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+import java.util.TreeMap;
+import com.kingsrook.qqq.middleware.javalin.schemabuilder.ToSchema;
+import com.kingsrook.qqq.openapi.model.Schema;
+import com.kingsrook.qqq.openapi.model.Type;
+
+
+/*******************************************************************************
+ ** Versioned wire records and explicit schemas, independent of persistence DTOs.
+ *******************************************************************************/
+public final class CollaborationSchemas
+{
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private CollaborationSchemas()
+   {
+   }
+
+   /*******************************************************************************
+    ** A saved navigation target, with availability rechecked for the caller.
+    *******************************************************************************/
+   public record CollaborationFavoriteV1(Integer id, String targetType, String targetName, String recordId, String label, String folder, Integer sortOrder, Boolean available, String href) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("A saved navigation target, with availability rechecked for the caller.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("id", new Schema().withType(Type.INTEGER).withDescription("Favorite identifier.").withNullable(true)),
+            Map.entry("targetType", new Schema().withType(Type.STRING).withEnumValues(List.of("TABLE","APP","RECORD","PROCESS","REPORT","SAVED_VIEW")).withDescription("Kind of navigation target.").withNullable(true)),
+            Map.entry("targetName", new Schema().withType(Type.STRING).withDescription("Metadata name of the table, app, process, report or saved view.").withNullable(true)),
+            Map.entry("recordId", new Schema().withType(Type.STRING).withDescription("Canonical record key; null for non-record targets.").withNullable(true)),
+            Map.entry("label", new Schema().withType(Type.STRING).withDescription("Current display label; Unavailable when access is lost.").withNullable(true)),
+            Map.entry("folder", new Schema().withType(Type.STRING).withDescription("Optional personal grouping.").withNullable(true)),
+            Map.entry("sortOrder", new Schema().withType(Type.INTEGER).withDescription("Position in the personal list.").withNullable(true)),
+            Map.entry("available", new Schema().withType(Type.BOOLEAN).withDescription("Whether the caller can currently open this target.").withNullable(true)),
+            Map.entry("href", new Schema().withType(Type.STRING).withDescription("Navigation link, absent for unavailable targets.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** An attachment visible through its parent record; no storage coordinates are exposed.
+    *******************************************************************************/
+   public record CollaborationAttachmentV1(Integer id, String tableName, String recordId, String fileName, String contentType, Long sizeBytes, String sha256, String description, String createdByUserId, Instant createDate, Boolean canDelete) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("An attachment visible through its parent record; no storage coordinates are exposed.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("id", new Schema().withType(Type.INTEGER).withDescription("Attachment identifier.").withNullable(true)),
+            Map.entry("tableName", new Schema().withType(Type.STRING).withDescription("Parent table metadata name.").withNullable(true)),
+            Map.entry("recordId", new Schema().withType(Type.STRING).withDescription("Canonical parent record key.").withNullable(true)),
+            Map.entry("fileName", new Schema().withType(Type.STRING).withDescription("Safe display filename.").withNullable(true)),
+            Map.entry("contentType", new Schema().withType(Type.STRING).withDescription("MIME content type.").withNullable(true)),
+            Map.entry("sizeBytes", new Schema().withType(Type.INTEGER).withDescription("Stored byte count.").withNullable(true)),
+            Map.entry("sha256", new Schema().withType(Type.STRING).withDescription("SHA-256 content digest.").withNullable(true)),
+            Map.entry("description", new Schema().withType(Type.STRING).withDescription("Optional description.").withNullable(true)),
+            Map.entry("createdByUserId", new Schema().withType(Type.STRING).withDescription("Uploader identity.").withNullable(true)),
+            Map.entry("createDate", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("Upload time.").withNullable(true)),
+            Map.entry("canDelete", new Schema().withType(Type.BOOLEAN).withDescription("Whether the caller may change or delete this attachment.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** An approved tag or the caller's pending suggestion.
+    *******************************************************************************/
+   public record CollaborationTagV1(Integer id, String name, String label, String color, String tableName, Boolean approved, Integer usageCount) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("An approved tag or the caller's pending suggestion.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("id", new Schema().withType(Type.INTEGER).withDescription("Tag identifier.").withNullable(true)),
+            Map.entry("name", new Schema().withType(Type.STRING).withDescription("Normalized vocabulary name.").withNullable(true)),
+            Map.entry("label", new Schema().withType(Type.STRING).withDescription("Display label.").withNullable(true)),
+            Map.entry("color", new Schema().withType(Type.STRING).withDescription("Optional display color.").withNullable(true)),
+            Map.entry("tableName", new Schema().withType(Type.STRING).withDescription("Table scope; null means global.").withNullable(true)),
+            Map.entry("approved", new Schema().withType(Type.BOOLEAN).withDescription("Whether anyone may apply this tag.").withNullable(true)),
+            Map.entry("usageCount", new Schema().withType(Type.INTEGER).withDescription("Number of record associations.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** An active directory entry.
+    *******************************************************************************/
+   public record CollaborationPersonV1(String userId, String displayName, String email, Instant lastSeenAt) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("An active directory entry.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("userId", new Schema().withType(Type.STRING).withDescription("Stable user identity.").withNullable(true)),
+            Map.entry("displayName", new Schema().withType(Type.STRING).withDescription("Display name.").withNullable(true)),
+            Map.entry("email", new Schema().withType(Type.STRING).withDescription("Directory email, if known.").withNullable(true)),
+            Map.entry("lastSeenAt", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("Most recent directory refresh time.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** A mention embedded in a comment.
+    *******************************************************************************/
+   public record CollaborationMentionV1(String userId, Boolean visible) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("A mention embedded in a comment.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("userId", new Schema().withType(Type.STRING).withDescription("Mentioned user identity.").withNullable(true)),
+            Map.entry("visible", new Schema().withType(Type.BOOLEAN).withDescription("Whether recipient access was confirmed when mentioned.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** A matching person and their known parent access.
+    *******************************************************************************/
+   public record CollaborationMentionCandidateV1(CollaborationPersonV1 person, String canRead) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("A matching person and their known parent access.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("person", new Schema().withRefToSchema("CollaborationPersonV1").withDescription("Directory identity.").withNullable(true)),
+            Map.entry("canRead", new Schema().withType(Type.STRING).withEnumValues(List.of("true","false","unknown")).withDescription("Recipient access: string true, false, or unknown when it cannot be established.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** A comment or reply; deleted comments retain their position without body text.
+    *******************************************************************************/
+   public record CollaborationCommentV1(Integer id, Integer threadId, Integer parentCommentId, String body, String fieldName, String authorUserId, String authorDisplayName, Instant createdAt, Instant editedAt, Boolean deleted, Boolean resolved, Boolean canEdit, Boolean canDelete, List<CollaborationMentionV1> mentions, List<CollaborationCommentV1> replies) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("A comment or reply; deleted comments retain their position without body text.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("id", new Schema().withType(Type.INTEGER).withDescription("Comment identifier.").withNullable(true)),
+            Map.entry("threadId", new Schema().withType(Type.INTEGER).withDescription("Root thread identifier; null on roots.").withNullable(true)),
+            Map.entry("parentCommentId", new Schema().withType(Type.INTEGER).withDescription("Root comment for a reply; null on roots.").withNullable(true)),
+            Map.entry("body", new Schema().withType(Type.STRING).withDescription("Plain text with mention tokens; null for deleted comments.").withNullable(true)),
+            Map.entry("fieldName", new Schema().withType(Type.STRING).withDescription("Optional field being discussed.").withNullable(true)),
+            Map.entry("authorUserId", new Schema().withType(Type.STRING).withDescription("Author identity.").withNullable(true)),
+            Map.entry("authorDisplayName", new Schema().withType(Type.STRING).withDescription("Author display name.").withNullable(true)),
+            Map.entry("createdAt", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("Creation time.").withNullable(true)),
+            Map.entry("editedAt", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("Last edit time, if edited.").withNullable(true)),
+            Map.entry("deleted", new Schema().withType(Type.BOOLEAN).withDescription("Whether the comment is soft deleted.").withNullable(true)),
+            Map.entry("resolved", new Schema().withType(Type.BOOLEAN).withDescription("Whether the thread is resolved.").withNullable(true)),
+            Map.entry("canEdit", new Schema().withType(Type.BOOLEAN).withDescription("Caller may edit the body.").withNullable(true)),
+            Map.entry("canDelete", new Schema().withType(Type.BOOLEAN).withDescription("Caller may delete this comment.").withNullable(true)),
+            Map.entry("mentions", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationMentionV1")).withDescription("Mention recipients.").withNullable(true)),
+            Map.entry("replies", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationCommentV1")).withDescription("Replies in oldest-first order; empty on replies.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** A previous comment body.
+    *******************************************************************************/
+   public record CollaborationCommentRevisionV1(Integer id, String body, Instant editedAt, String editedByUserId) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("A previous comment body.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("id", new Schema().withType(Type.INTEGER).withDescription("Revision identifier.").withNullable(true)),
+            Map.entry("body", new Schema().withType(Type.STRING).withDescription("Previous body text.").withNullable(true)),
+            Map.entry("editedAt", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("Time the body was replaced.").withNullable(true)),
+            Map.entry("editedByUserId", new Schema().withType(Type.STRING).withDescription("Editor identity.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** A subscription to record changes and comments.
+    *******************************************************************************/
+   public record CollaborationFollowV1(Integer id, String userId, String reason, Boolean notifyOnChange, Boolean notifyOnComment, Instant mutedUntil) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("A subscription to record changes and comments.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("id", new Schema().withType(Type.INTEGER).withDescription("Subscription identifier.").withNullable(true)),
+            Map.entry("userId", new Schema().withType(Type.STRING).withDescription("Follower identity.").withNullable(true)),
+            Map.entry("reason", new Schema().withType(Type.STRING).withEnumValues(List.of("MANUAL", "AUTHOR", "COMMENTED", "MENTIONED", "ASSIGNED", "SHARED")).withDescription("How following began.").withNullable(true)),
+            Map.entry("notifyOnChange", new Schema().withType(Type.BOOLEAN).withDescription("Receive record change digests.").withNullable(true)),
+            Map.entry("notifyOnComment", new Schema().withType(Type.BOOLEAN).withDescription("Receive new comment notifications.").withNullable(true)),
+            Map.entry("mutedUntil", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("Notifications muted until this time, if set.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** The current caller's subscription state.
+    *******************************************************************************/
+   public record CollaborationFollowStateV1(Boolean following, CollaborationFollowV1 follow) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("The current caller's subscription state.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("following", new Schema().withType(Type.BOOLEAN).withDescription("Whether the caller follows the record.").withNullable(true)),
+            Map.entry("follow", new Schema().withRefToSchema("CollaborationFollowV1").withDescription("Subscription settings; null when not following.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** A permitted field change from a core audit.
+    *******************************************************************************/
+   public record CollaborationTimelineDetailV1(String fieldName, String oldValue, String newValue, String message) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("A permitted field change from a core audit.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("fieldName", new Schema().withType(Type.STRING).withDescription("Changed field metadata name.").withNullable(true)),
+            Map.entry("oldValue", new Schema().withType(Type.STRING).withDescription("Previous display value.").withNullable(true)),
+            Map.entry("newValue", new Schema().withType(Type.STRING).withDescription("New display value.").withNullable(true)),
+            Map.entry("message", new Schema().withType(Type.STRING).withDescription("Optional audit message.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** One visible event in the merged record timeline.
+    *******************************************************************************/
+   public record CollaborationTimelineItemV1(String kind, Long id, Instant at, String actorUserId, String actorName, String summary, List<CollaborationTimelineDetailV1> details, String refTable, String refId) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("One visible event in the merged record timeline.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("kind", new Schema().withType(Type.STRING).withEnumValues(List.of("ACTIVITY","AUDIT")).withDescription("Event source.").withNullable(true)),
+            Map.entry("id", new Schema().withType(Type.INTEGER).withDescription("Identifier within the source.").withNullable(true)),
+            Map.entry("at", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("Event time.").withNullable(true)),
+            Map.entry("actorUserId", new Schema().withType(Type.STRING).withDescription("Actor identity, when known.").withNullable(true)),
+            Map.entry("actorName", new Schema().withType(Type.STRING).withDescription("Actor display name.").withNullable(true)),
+            Map.entry("summary", new Schema().withType(Type.STRING).withDescription("Human-readable event summary.").withNullable(true)),
+            Map.entry("details", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationTimelineDetailV1")).withDescription("Field details filtered by caller permissions.").withNullable(true)),
+            Map.entry("refTable", new Schema().withType(Type.STRING).withDescription("Related table metadata name.").withNullable(true)),
+            Map.entry("refId", new Schema().withType(Type.STRING).withDescription("Related record key.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Ordered personal favorites.
+    *******************************************************************************/
+   public record CollaborationFavoriteListV1(List<CollaborationFavoriteV1> items, String nextCursor) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Ordered personal favorites.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("items", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationFavoriteV1")).withDescription("Ordered personal favorites.").withNullable(true)),
+            Map.entry("nextCursor", new Schema().withType(Type.STRING).withDescription("Opaque continuation token; null when finished or the service has no continuation support.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Most recent visible targets, at most fifty.
+    *******************************************************************************/
+   public record CollaborationRecentListV1(List<CollaborationFavoriteV1> items, String nextCursor) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Most recent visible targets, at most fifty.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("items", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationFavoriteV1")).withDescription("Most recent visible targets, at most fifty.").withNullable(true)),
+            Map.entry("nextCursor", new Schema().withType(Type.STRING).withDescription("Opaque continuation token; null when finished or the service has no continuation support.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Attachments, newest first.
+    *******************************************************************************/
+   public record CollaborationAttachmentListV1(List<CollaborationAttachmentV1> items, String nextCursor) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Attachments, newest first.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("items", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationAttachmentV1")).withDescription("Attachments, newest first.").withNullable(true)),
+            Map.entry("nextCursor", new Schema().withType(Type.STRING).withDescription("Opaque continuation token; null when finished or the service has no continuation support.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Available or applied tags.
+    *******************************************************************************/
+   public record CollaborationTagListV1(List<CollaborationTagV1> items, String nextCursor) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Available or applied tags.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("items", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationTagV1")).withDescription("Available or applied tags.").withNullable(true)),
+            Map.entry("nextCursor", new Schema().withType(Type.STRING).withDescription("Opaque continuation token; null when finished or the service has no continuation support.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Matching active directory entries.
+    *******************************************************************************/
+   public record CollaborationPersonListV1(List<CollaborationPersonV1> items, String nextCursor) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Matching active directory entries.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("items", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationPersonV1")).withDescription("Matching active directory entries.").withNullable(true)),
+            Map.entry("nextCursor", new Schema().withType(Type.STRING).withDescription("Opaque continuation token; null when finished or the service has no continuation support.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Candidates ranked with record participants first.
+    *******************************************************************************/
+   public record CollaborationMentionCandidateListV1(List<CollaborationMentionCandidateV1> items, String nextCursor) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Candidates ranked with record participants first.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("items", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationMentionCandidateV1")).withDescription("Candidates ranked with record participants first.").withNullable(true)),
+            Map.entry("nextCursor", new Schema().withType(Type.STRING).withDescription("Opaque continuation token; null when finished or the service has no continuation support.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Root threads by latest activity, with replies.
+    *******************************************************************************/
+   public record CollaborationCommentPageV1(List<CollaborationCommentV1> threads, String nextCursor) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Root threads by latest activity, with replies.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("threads", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationCommentV1")).withDescription("Root threads by latest activity, with replies.").withNullable(true)),
+            Map.entry("nextCursor", new Schema().withType(Type.STRING).withDescription("Opaque continuation token; null when finished or the service has no continuation support.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Previous bodies in edit order.
+    *******************************************************************************/
+   public record CollaborationCommentHistoryV1(List<CollaborationCommentRevisionV1> items, String nextCursor) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Previous bodies in edit order.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("items", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationCommentRevisionV1")).withDescription("Previous bodies in edit order.").withNullable(true)),
+            Map.entry("nextCursor", new Schema().withType(Type.STRING).withDescription("Opaque continuation token; null when finished or the service has no continuation support.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Subscriptions for this record.
+    *******************************************************************************/
+   public record CollaborationFollowerListV1(List<CollaborationFollowV1> items, String nextCursor) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Subscriptions for this record.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("items", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationFollowV1")).withDescription("Subscriptions for this record.").withNullable(true)),
+            Map.entry("nextCursor", new Schema().withType(Type.STRING).withDescription("Opaque continuation token; null when finished or the service has no continuation support.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Merged events, newest first.
+    *******************************************************************************/
+   public record CollaborationTimelinePageV1(List<CollaborationTimelineItemV1> items, String nextCursor) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Merged events, newest first.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("items", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationTimelineItemV1")).withDescription("Merged events, newest first.").withNullable(true)),
+            Map.entry("nextCursor", new Schema().withType(Type.STRING).withDescription("Opaque continuation token; null when finished or the service has no continuation support.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Acknowledgement of a completed mutation.
+    *******************************************************************************/
+   public record CollaborationMutationResultV1(Boolean success) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Acknowledgement of a completed mutation.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("success", new Schema().withType(Type.BOOLEAN).withDescription("True after the requested operation completes.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Temporary access to file bytes. Clients follow url.
+    *******************************************************************************/
+   public record CollaborationDownloadV1(String url) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Temporary access to file bytes. Clients follow url.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("url", new Schema().withType(Type.STRING).withDescription("Presigned URL, valid for five minutes. Clients follow url; never persist it.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Standard QQQ error response.
+    *******************************************************************************/
+   public record CollaborationErrorV1(String error) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Standard QQQ error response.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("error", new Schema().withType(Type.STRING).withDescription("Human-readable reason the operation failed.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Target to star, unstar, or record as recently viewed.
+    *******************************************************************************/
+   public record CollaborationTargetRequestV1(String targetType, String targetName, String recordId) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Target to star, unstar, or record as recently viewed.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("targetType", new Schema().withType(Type.STRING).withEnumValues(List.of("TABLE","APP","RECORD","PROCESS","REPORT","SAVED_VIEW")).withDescription("Required target kind.").withNullable(true)),
+            Map.entry("targetName", new Schema().withType(Type.STRING).withDescription("Required metadata name.").withNullable(true)),
+            Map.entry("recordId", new Schema().withType(Type.STRING).withDescription("Required for RECORD; omitted otherwise.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Move selected favorites first and optionally assign folders.
+    *******************************************************************************/
+   public record CollaborationFavoriteOrderRequestV1(List<Integer> ids, Map<String, String> folders) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Move selected favorites first and optionally assign folders.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("ids", new Schema().withType(Type.ARRAY).withItems(new Schema().withType(Type.INTEGER)).withDescription("Required ordered favorite identifiers, with no duplicates.").withNullable(true)),
+            Map.entry("folders", new Schema().withType(Type.OBJECT).withAdditionalProperties(new Schema().withType(Type.STRING).withNullable(true)).withDescription("Optional map from favorite identifier to folder; null values clear folders.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Change attachment display metadata.
+    *******************************************************************************/
+   public record CollaborationAttachmentPatchRequestV1(String fileName, String description) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Change attachment display metadata.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("fileName", new Schema().withType(Type.STRING).withDescription("Optional new display filename; null leaves unchanged.").withNullable(true)),
+            Map.entry("description", new Schema().withType(Type.STRING).withDescription("Optional description; empty clears, null leaves unchanged.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Multipart upload with exactly one file part named file.
+    *******************************************************************************/
+   public record CollaborationAttachmentUploadRequestV1(String file, String description) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Multipart upload with exactly one file part named file.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("file", new Schema().withType(Type.STRING).withFormat("binary").withDescription("Required file content.").withNullable(true)),
+            Map.entry("description", new Schema().withType(Type.STRING).withDescription("Optional description.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Create a tag or suggest one under the table policy.
+    *******************************************************************************/
+   public record CollaborationTagCreateRequestV1(String table, String label, String color) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Create a tag or suggest one under the table policy.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("table", new Schema().withType(Type.STRING).withDescription("Required table metadata name.").withNullable(true)),
+            Map.entry("label", new Schema().withType(Type.STRING).withDescription("Required display label, 1 to 60 characters.").withNullable(true)),
+            Map.entry("color", new Schema().withType(Type.STRING).withDescription("Optional display color.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Add and remove tag associations in one request.
+    *******************************************************************************/
+   public record CollaborationTagApplyRequestV1(List<Integer> add, List<Integer> remove) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Add and remove tag associations in one request.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("add", new Schema().withType(Type.ARRAY).withItems(new Schema().withType(Type.INTEGER)).withDescription("Tag identifiers to add; omitted means none.").withNullable(true)),
+            Map.entry("remove", new Schema().withType(Type.ARRAY).withItems(new Schema().withType(Type.INTEGER)).withDescription("Tag identifiers to remove; omitted means none.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Post a root comment or one-level reply.
+    *******************************************************************************/
+   public record CollaborationCommentPostRequestV1(String body, Integer parentCommentId, String fieldName) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Post a root comment or one-level reply.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("body", new Schema().withType(Type.STRING).withDescription("Required body, 1 to 20000 characters; mentions use @[Name](user:id).").withNullable(true)),
+            Map.entry("parentCommentId", new Schema().withType(Type.INTEGER).withDescription("Optional comment to reply to.").withNullable(true)),
+            Map.entry("fieldName", new Schema().withType(Type.STRING).withDescription("Optional existing parent field name.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Replace the caller's comment body.
+    *******************************************************************************/
+   public record CollaborationCommentEditRequestV1(String body) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Replace the caller's comment body.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("body", new Schema().withType(Type.STRING).withDescription("Required replacement body, 1 to 20000 characters.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Configure the caller's follow preferences.
+    *******************************************************************************/
+   public record CollaborationFollowRequestV1(Boolean notifyOnChange, Boolean notifyOnComment) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Describe this versioned body for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withDescription("Configure the caller's follow preferences.").withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("notifyOnChange", new Schema().withType(Type.BOOLEAN).withDescription("Optional change notifications preference; omission retains current setting.").withNullable(true)),
+            Map.entry("notifyOnComment", new Schema().withType(Type.BOOLEAN).withDescription("Optional comment notifications preference; omission retains current setting.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** All named components referenced by the extension.
+    *******************************************************************************/
+   public static Map<String, Schema> components()
+   {
+      Map<String, Schema> schemas = new TreeMap<>();
+      schemas.put("CollaborationFavoriteV1", new CollaborationFavoriteV1(null, null, null, null, null, null, null, null, null).toSchema());
+      schemas.put("CollaborationAttachmentV1", new CollaborationAttachmentV1(null, null, null, null, null, null, null, null, null, null, null).toSchema());
+      schemas.put("CollaborationTagV1", new CollaborationTagV1(null, null, null, null, null, null, null).toSchema());
+      schemas.put("CollaborationPersonV1", new CollaborationPersonV1(null, null, null, null).toSchema());
+      schemas.put("CollaborationMentionV1", new CollaborationMentionV1(null, null).toSchema());
+      schemas.put("CollaborationMentionCandidateV1", new CollaborationMentionCandidateV1(null, null).toSchema());
+      schemas.put("CollaborationCommentV1", new CollaborationCommentV1(null, null, null, null, null, null, null, null, null, null, null, null, null, null, null).toSchema());
+      schemas.put("CollaborationCommentRevisionV1", new CollaborationCommentRevisionV1(null, null, null, null).toSchema());
+      schemas.put("CollaborationFollowV1", new CollaborationFollowV1(null, null, null, null, null, null).toSchema());
+      schemas.put("CollaborationFollowStateV1", new CollaborationFollowStateV1(null, null).toSchema());
+      schemas.put("CollaborationTimelineDetailV1", new CollaborationTimelineDetailV1(null, null, null, null).toSchema());
+      schemas.put("CollaborationTimelineItemV1", new CollaborationTimelineItemV1(null, null, null, null, null, null, null, null, null).toSchema());
+      schemas.put("CollaborationFavoriteListV1", new CollaborationFavoriteListV1(null, null).toSchema());
+      schemas.put("CollaborationRecentListV1", new CollaborationRecentListV1(null, null).toSchema());
+      schemas.put("CollaborationAttachmentListV1", new CollaborationAttachmentListV1(null, null).toSchema());
+      schemas.put("CollaborationTagListV1", new CollaborationTagListV1(null, null).toSchema());
+      schemas.put("CollaborationPersonListV1", new CollaborationPersonListV1(null, null).toSchema());
+      schemas.put("CollaborationMentionCandidateListV1", new CollaborationMentionCandidateListV1(null, null).toSchema());
+      schemas.put("CollaborationCommentPageV1", new CollaborationCommentPageV1(null, null).toSchema());
+      schemas.put("CollaborationCommentHistoryV1", new CollaborationCommentHistoryV1(null, null).toSchema());
+      schemas.put("CollaborationFollowerListV1", new CollaborationFollowerListV1(null, null).toSchema());
+      schemas.put("CollaborationTimelinePageV1", new CollaborationTimelinePageV1(null, null).toSchema());
+      schemas.put("CollaborationMutationResultV1", new CollaborationMutationResultV1(null).toSchema());
+      schemas.put("CollaborationDownloadV1", new CollaborationDownloadV1(null).toSchema());
+      schemas.put("CollaborationErrorV1", new CollaborationErrorV1(null).toSchema());
+      schemas.put("CollaborationTargetRequestV1", new CollaborationTargetRequestV1(null, null, null).toSchema());
+      schemas.put("CollaborationFavoriteOrderRequestV1", new CollaborationFavoriteOrderRequestV1(null, null).toSchema());
+      schemas.put("CollaborationAttachmentPatchRequestV1", new CollaborationAttachmentPatchRequestV1(null, null).toSchema());
+      schemas.put("CollaborationAttachmentUploadRequestV1", new CollaborationAttachmentUploadRequestV1(null, null).toSchema());
+      schemas.put("CollaborationTagCreateRequestV1", new CollaborationTagCreateRequestV1(null, null, null).toSchema());
+      schemas.put("CollaborationTagApplyRequestV1", new CollaborationTagApplyRequestV1(null, null).toSchema());
+      schemas.put("CollaborationCommentPostRequestV1", new CollaborationCommentPostRequestV1(null, null, null).toSchema());
+      schemas.put("CollaborationCommentEditRequestV1", new CollaborationCommentEditRequestV1(null).toSchema());
+      schemas.put("CollaborationFollowRequestV1", new CollaborationFollowRequestV1(null, null).toSchema());
+      schemas.putAll(CollaborationWorkSchemas.components());
+      return (schemas);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/CollaborationViews.java

@@ -0,0 +1,191 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationAttachmentV1;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationCommentRevisionV1;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationCommentV1;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationFavoriteV1;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationFollowV1;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationMentionCandidateV1;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationMentionV1;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationPersonV1;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationTagV1;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationTimelineDetailV1;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationTimelineItemV1;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentEntry;
+import com.kingsrook.qbits.collaboration.comments.CommentEntry;
+import com.kingsrook.qbits.collaboration.comments.CommentRevision;
+import com.kingsrook.qbits.collaboration.comments.MentionCandidate;
+import com.kingsrook.qbits.collaboration.comments.MentionEntry;
+import com.kingsrook.qbits.collaboration.favorites.FavoriteEntry;
+import com.kingsrook.qbits.collaboration.follow.FollowEntry;
+import com.kingsrook.qbits.collaboration.people.PersonEntry;
+import com.kingsrook.qbits.collaboration.tags.TagEntry;
+import com.kingsrook.qbits.collaboration.timeline.TimelineDetail;
+import com.kingsrook.qbits.collaboration.timeline.TimelineItem;
+
+
+/*******************************************************************************
+ ** Map service results to the stable UI API wire types.
+ *******************************************************************************/
+final class CollaborationViews
+{
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private CollaborationViews()
+   {
+   }
+
+   /*******************************************************************************
+    ** Project favorite display data.
+    *******************************************************************************/
+   static CollaborationFavoriteV1 favorite(FavoriteEntry value)
+   {
+      return (new CollaborationFavoriteV1(
+         value.id(), value.targetType(), value.targetName(), value.recordId(), value.label(), value.folder(), value.sortOrder(), value.available(), value.href()));
+   }
+
+   /*******************************************************************************
+    ** Project attachment display data.
+    *******************************************************************************/
+   static CollaborationAttachmentV1 attachment(AttachmentEntry value)
+   {
+      return (new CollaborationAttachmentV1(
+         value.id(), value.tableName(), value.recordId(), value.fileName(), value.contentType(), value.sizeBytes(), value.sha256(), value.description(), value.createdByUserId(), value.createDate(), value.canDelete()));
+   }
+
+   /*******************************************************************************
+    ** Project tag display data.
+    *******************************************************************************/
+   static CollaborationTagV1 tag(TagEntry value)
+   {
+      return (new CollaborationTagV1(
+         value.id(), value.name(), value.label(), value.color(), value.tableName(), value.approved(), value.usageCount()));
+   }
+
+   /*******************************************************************************
+    ** Project person display data.
+    *******************************************************************************/
+   static CollaborationPersonV1 person(PersonEntry value)
+   {
+      return (new CollaborationPersonV1(
+         value.userId(), value.displayName(), value.email(), value.lastSeenAt()));
+   }
+
+   /*******************************************************************************
+    ** Project mention display data.
+    *******************************************************************************/
+   static CollaborationMentionV1 mention(MentionEntry value)
+   {
+      return (new CollaborationMentionV1(
+         value.userId(), value.visible()));
+   }
+
+   /*******************************************************************************
+    ** Project comment display data.
+    *******************************************************************************/
+   static CollaborationCommentV1 comment(CommentEntry value)
+   {
+      return (new CollaborationCommentV1(
+         value.id(), value.threadId(), value.parentCommentId(), value.body(), value.fieldName(), value.authorUserId(), value.authorDisplayName(), value.createdAt(), value.editedAt(), value.deleted(), value.resolved(), value.canEdit(), value.canDelete(), value.mentions().stream().map(CollaborationViews::mention).toList(), value.replies().stream().map(CollaborationViews::comment).toList()));
+   }
+
+   /*******************************************************************************
+    ** Project commentrevision display data.
+    *******************************************************************************/
+   static CollaborationCommentRevisionV1 commentRevision(CommentRevision value)
+   {
+      return (new CollaborationCommentRevisionV1(
+         value.id(), value.body(), value.editedAt(), value.editedByUserId()));
+   }
+
+   /*******************************************************************************
+    ** Project follow display data.
+    *******************************************************************************/
+   static CollaborationFollowV1 follow(FollowEntry value)
+   {
+      return (new CollaborationFollowV1(
+         value.id(), value.userId(), value.reason(), value.notifyOnChange(), value.notifyOnComment(), value.mutedUntil()));
+   }
+
+   /*******************************************************************************
+    ** Project timelinedetail display data.
+    *******************************************************************************/
+   static CollaborationTimelineDetailV1 timelineDetail(TimelineDetail value)
+   {
+      return (new CollaborationTimelineDetailV1(
+         value.fieldName(), value.oldValue(), value.newValue(), value.message()));
+   }
+
+   /*******************************************************************************
+    ** Project timelineitem display data.
+    *******************************************************************************/
+   static CollaborationTimelineItemV1 timelineItem(TimelineItem value)
+   {
+      return (new CollaborationTimelineItemV1(
+         value.kind(), value.id(), value.at(), value.actorUserId(), value.actorName(), value.summary(), value.details().stream().map(CollaborationViews::timelineDetail).toList(), value.refTable(), value.refId()));
+   }
+
+   /*******************************************************************************
+    ** Represent access uncertainty explicitly instead of serializing Optional.
+    *******************************************************************************/
+   static CollaborationMentionCandidateV1 mentionCandidate(MentionCandidate value)
+   {
+      return (new CollaborationMentionCandidateV1(person(value.person()), value.canRead().map(Object::toString).orElse("unknown")));
+   }
+
+   /*******************************************************************************
+    ** Project Share public fields.
+    *******************************************************************************/
+   static CollaborationWorkSchemas.CollaborationShareV1 share(com.kingsrook.qqq.backend.core.model.data.QRecord row)
+   {
+      return (new CollaborationWorkSchemas.CollaborationShareV1(row.getValueInteger("id"), row.getValueString("tableName"), row.getValueString("recordId"), row.getValueString("fromUserId"), row.getValueString("toUserId"), row.getValueString("message"), row.getValueBoolean("recipientCouldRead"), row.getValueInstant("sentAt")));
+   }
+
+   /*******************************************************************************
+    ** Project AccessRequest public fields.
+    *******************************************************************************/
+   static CollaborationWorkSchemas.CollaborationAccessRequestV1 accessRequest(com.kingsrook.qqq.backend.core.model.data.QRecord row)
+   {
+      return (new CollaborationWorkSchemas.CollaborationAccessRequestV1(row.getValueInteger("id"), row.getValueString("tableName"), row.getValueString("recordId"), row.getValueString("requesterUserId"), row.getValueString("message"), row.getValueString("status"), row.getValueInstant("handledAt"), row.getValueString("note")));
+   }
+
+   /*******************************************************************************
+    ** Project Task public fields.
+    *******************************************************************************/
+   static CollaborationWorkSchemas.CollaborationTaskV1 task(com.kingsrook.qqq.backend.core.model.data.QRecord row)
+   {
+      return (new CollaborationWorkSchemas.CollaborationTaskV1(row.getValueInteger("id"), row.getValueString("tableName"), row.getValueString("recordId"), row.getValueString("title"), row.getValueString("notes"), row.getValueString("assigneeUserId"), row.getValueInstant("dueAt"), row.getValueInstant("remindAt"), row.getValueString("status"), row.getValueString("createdByUserId"), row.getValueInstant("completedAt"), row.getValueString("completedByUserId")));
+   }
+
+   /*******************************************************************************
+    ** Project Assignment public fields.
+    *******************************************************************************/
+   static CollaborationWorkSchemas.CollaborationAssignmentV1 assignment(com.kingsrook.qqq.backend.core.model.data.QRecord row)
+   {
+      return (new CollaborationWorkSchemas.CollaborationAssignmentV1(row.getValueInteger("id"), row.getValueString("tableName"), row.getValueString("recordId"), row.getValueString("ownerUserId"), row.getValueString("assigneeUserId")));
+   }
+
+}

src/main/java/com/kingsrook/qbits/collaboration/api/CollaborationWorkSchemas.java

@@ -0,0 +1,375 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+import java.util.TreeMap;
+import com.kingsrook.qqq.middleware.javalin.schemabuilder.ToSchema;
+import com.kingsrook.qqq.openapi.model.Schema;
+import com.kingsrook.qqq.openapi.model.Type;
+
+/*******************************************************************************
+ ** Typed sharing, access request, task and work contracts.
+ *******************************************************************************/
+public final class CollaborationWorkSchemas
+{
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private CollaborationWorkSchemas()
+   {
+   }
+
+   /*******************************************************************************
+    ** Versioned Link body.
+    *******************************************************************************/
+   public record CollaborationLinkV1(String url, String label) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("url", new Schema().withType(Type.STRING).withDescription("url.").withNullable(true)),
+            Map.entry("label", new Schema().withType(Type.STRING).withDescription("label.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned ShareRecipient body.
+    *******************************************************************************/
+   public record CollaborationShareRecipientV1(String userId, String displayName, Boolean canRead) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("userId", new Schema().withType(Type.STRING).withDescription("userId.").withNullable(true)),
+            Map.entry("displayName", new Schema().withType(Type.STRING).withDescription("displayName.").withNullable(true)),
+            Map.entry("canRead", new Schema().withType(Type.BOOLEAN).withDescription("canRead.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned SharePreview body.
+    *******************************************************************************/
+   public record CollaborationSharePreviewV1(List<CollaborationShareRecipientV1> recipients) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("recipients", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationShareRecipientV1")).withDescription("recipients.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned Share body.
+    *******************************************************************************/
+   public record CollaborationShareV1(Integer id, String tableName, String recordId, String fromUserId, String toUserId, String message, Boolean recipientCouldRead, Instant sentAt) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("id", new Schema().withType(Type.INTEGER).withDescription("id.").withNullable(true)),
+            Map.entry("tableName", new Schema().withType(Type.STRING).withDescription("tableName.").withNullable(true)),
+            Map.entry("recordId", new Schema().withType(Type.STRING).withDescription("recordId.").withNullable(true)),
+            Map.entry("fromUserId", new Schema().withType(Type.STRING).withDescription("fromUserId.").withNullable(true)),
+            Map.entry("toUserId", new Schema().withType(Type.STRING).withDescription("toUserId.").withNullable(true)),
+            Map.entry("message", new Schema().withType(Type.STRING).withDescription("message.").withNullable(true)),
+            Map.entry("recipientCouldRead", new Schema().withType(Type.BOOLEAN).withDescription("recipientCouldRead.").withNullable(true)),
+            Map.entry("sentAt", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("sentAt.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned ShareList body.
+    *******************************************************************************/
+   public record CollaborationShareListV1(List<CollaborationShareV1> items) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("items", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationShareV1")).withDescription("items.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned ShareRequest body.
+    *******************************************************************************/
+   public record CollaborationShareRequestV1(List<String> toUserIds, String message) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("toUserIds", new Schema().withType(Type.ARRAY).withItems(new Schema().withType(Type.STRING)).withDescription("toUserIds.").withNullable(true)),
+            Map.entry("message", new Schema().withType(Type.STRING).withDescription("message.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned AccessRequest body.
+    *******************************************************************************/
+   public record CollaborationAccessRequestV1(Integer id, String tableName, String recordId, String requesterUserId, String message, String status, Instant handledAt, String note) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("id", new Schema().withType(Type.INTEGER).withDescription("id.").withNullable(true)),
+            Map.entry("tableName", new Schema().withType(Type.STRING).withDescription("tableName.").withNullable(true)),
+            Map.entry("recordId", new Schema().withType(Type.STRING).withDescription("recordId.").withNullable(true)),
+            Map.entry("requesterUserId", new Schema().withType(Type.STRING).withDescription("requesterUserId.").withNullable(true)),
+            Map.entry("message", new Schema().withType(Type.STRING).withDescription("message.").withNullable(true)),
+            Map.entry("status", new Schema().withType(Type.STRING).withDescription("status.").withNullable(true)),
+            Map.entry("handledAt", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("handledAt.").withNullable(true)),
+            Map.entry("note", new Schema().withType(Type.STRING).withDescription("note.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned AccessRequestCreateRequest body.
+    *******************************************************************************/
+   public record CollaborationAccessRequestCreateRequestV1(String tableName, String recordId, String message, Integer shareId) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("tableName", new Schema().withType(Type.STRING).withDescription("tableName.").withNullable(true)),
+            Map.entry("recordId", new Schema().withType(Type.STRING).withDescription("recordId.").withNullable(true)),
+            Map.entry("message", new Schema().withType(Type.STRING).withDescription("message.").withNullable(true)),
+            Map.entry("shareId", new Schema().withType(Type.INTEGER).withDescription("shareId.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned AccessRequestList body.
+    *******************************************************************************/
+   public record CollaborationAccessRequestListV1(List<CollaborationAccessRequestV1> items, String nextCursor) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("items", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationAccessRequestV1")).withDescription("items.").withNullable(true)),
+            Map.entry("nextCursor", new Schema().withType(Type.STRING).withDescription("nextCursor.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned Task body.
+    *******************************************************************************/
+   public record CollaborationTaskV1(Integer id, String tableName, String recordId, String title, String notes, String assigneeUserId, Instant dueAt, Instant remindAt, String status, String createdByUserId, Instant completedAt, String completedByUserId) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("id", new Schema().withType(Type.INTEGER).withDescription("id.").withNullable(true)),
+            Map.entry("tableName", new Schema().withType(Type.STRING).withDescription("tableName.").withNullable(true)),
+            Map.entry("recordId", new Schema().withType(Type.STRING).withDescription("recordId.").withNullable(true)),
+            Map.entry("title", new Schema().withType(Type.STRING).withDescription("title.").withNullable(true)),
+            Map.entry("notes", new Schema().withType(Type.STRING).withDescription("notes.").withNullable(true)),
+            Map.entry("assigneeUserId", new Schema().withType(Type.STRING).withDescription("assigneeUserId.").withNullable(true)),
+            Map.entry("dueAt", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("dueAt.").withNullable(true)),
+            Map.entry("remindAt", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("remindAt.").withNullable(true)),
+            Map.entry("status", new Schema().withType(Type.STRING).withDescription("status.").withNullable(true)),
+            Map.entry("createdByUserId", new Schema().withType(Type.STRING).withDescription("createdByUserId.").withNullable(true)),
+            Map.entry("completedAt", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("completedAt.").withNullable(true)),
+            Map.entry("completedByUserId", new Schema().withType(Type.STRING).withDescription("completedByUserId.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned TaskCreateRequest body.
+    *******************************************************************************/
+   public record CollaborationTaskCreateRequestV1(String title, String notes, String assigneeUserId, String dueAt, String remindAt) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("title", new Schema().withType(Type.STRING).withDescription("title.").withNullable(true)),
+            Map.entry("notes", new Schema().withType(Type.STRING).withDescription("notes.").withNullable(true)),
+            Map.entry("assigneeUserId", new Schema().withType(Type.STRING).withDescription("assigneeUserId.").withNullable(true)),
+            Map.entry("dueAt", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("dueAt.").withNullable(true)),
+            Map.entry("remindAt", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("remindAt.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned TaskPatchRequest body.
+    *******************************************************************************/
+   public record CollaborationTaskPatchRequestV1(String title, String notes, String assigneeUserId, String dueAt, String remindAt, String status) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("title", new Schema().withType(Type.STRING).withDescription("title.").withNullable(true)),
+            Map.entry("notes", new Schema().withType(Type.STRING).withDescription("notes.").withNullable(true)),
+            Map.entry("assigneeUserId", new Schema().withType(Type.STRING).withDescription("assigneeUserId.").withNullable(true)),
+            Map.entry("dueAt", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("dueAt.").withNullable(true)),
+            Map.entry("remindAt", new Schema().withType(Type.STRING).withFormat("date-time").withDescription("remindAt.").withNullable(true)),
+            Map.entry("status", new Schema().withType(Type.STRING).withDescription("status.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned TaskList body.
+    *******************************************************************************/
+   public record CollaborationTaskListV1(List<CollaborationTaskV1> items, String nextCursor) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("items", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationTaskV1")).withDescription("items.").withNullable(true)),
+            Map.entry("nextCursor", new Schema().withType(Type.STRING).withDescription("nextCursor.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned AssignmentRequest body.
+    *******************************************************************************/
+   public record CollaborationAssignmentRequestV1(String ownerUserId, String assigneeUserId) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("ownerUserId", new Schema().withType(Type.STRING).withDescription("ownerUserId.").withNullable(true)),
+            Map.entry("assigneeUserId", new Schema().withType(Type.STRING).withDescription("assigneeUserId.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned Assignment body.
+    *******************************************************************************/
+   public record CollaborationAssignmentV1(Integer id, String tableName, String recordId, String ownerUserId, String assigneeUserId) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("id", new Schema().withType(Type.INTEGER).withDescription("id.").withNullable(true)),
+            Map.entry("tableName", new Schema().withType(Type.STRING).withDescription("tableName.").withNullable(true)),
+            Map.entry("recordId", new Schema().withType(Type.STRING).withDescription("recordId.").withNullable(true)),
+            Map.entry("ownerUserId", new Schema().withType(Type.STRING).withDescription("ownerUserId.").withNullable(true)),
+            Map.entry("assigneeUserId", new Schema().withType(Type.STRING).withDescription("assigneeUserId.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Versioned MyWork body.
+    *******************************************************************************/
+   public record CollaborationMyWorkV1(Long openTaskCount, List<CollaborationTaskV1> tasks, Map<String, Long> assignedRecordsByTable, Long unreadMentionCount) implements ToSchema
+   {
+      /*******************************************************************************
+       ** Explicit schema for generated clients.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         return (new Schema().withType(Type.OBJECT).withProperties(new TreeMap<>(Map.ofEntries(
+            Map.entry("openTaskCount", new Schema().withType(Type.INTEGER).withDescription("openTaskCount.").withNullable(true)),
+            Map.entry("tasks", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("CollaborationTaskV1")).withDescription("tasks.").withNullable(true)),
+            Map.entry("assignedRecordsByTable", new Schema().withType(Type.OBJECT).withAdditionalProperties(new Schema().withType(Type.INTEGER)).withDescription("assignedRecordsByTable.").withNullable(true)),
+            Map.entry("unreadMentionCount", new Schema().withType(Type.INTEGER).withDescription("unreadMentionCount.").withNullable(true))))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Named components used by these endpoints.
+    *******************************************************************************/
+   public static Map<String, Schema> components()
+   {
+      Map<String, Schema> schemas = new TreeMap<>();
+      schemas.put("CollaborationLinkV1", new CollaborationLinkV1(null, null).toSchema());
+      schemas.put("CollaborationShareRecipientV1", new CollaborationShareRecipientV1(null, null, null).toSchema());
+      schemas.put("CollaborationSharePreviewV1", new CollaborationSharePreviewV1(null).toSchema());
+      schemas.put("CollaborationShareV1", new CollaborationShareV1(null, null, null, null, null, null, null, null).toSchema());
+      schemas.put("CollaborationShareListV1", new CollaborationShareListV1(null).toSchema());
+      schemas.put("CollaborationShareRequestV1", new CollaborationShareRequestV1(null, null).toSchema());
+      schemas.put("CollaborationAccessRequestV1", new CollaborationAccessRequestV1(null, null, null, null, null, null, null, null).toSchema());
+      schemas.put("CollaborationAccessRequestCreateRequestV1", new CollaborationAccessRequestCreateRequestV1(null, null, null, null).toSchema());
+      schemas.put("CollaborationAccessRequestListV1", new CollaborationAccessRequestListV1(null, null).toSchema());
+      schemas.put("CollaborationTaskV1", new CollaborationTaskV1(null, null, null, null, null, null, null, null, null, null, null, null).toSchema());
+      schemas.put("CollaborationTaskCreateRequestV1", new CollaborationTaskCreateRequestV1(null, null, null, null, null).toSchema());
+      schemas.put("CollaborationTaskPatchRequestV1", new CollaborationTaskPatchRequestV1(null, null, null, null, null, null).toSchema());
+      schemas.put("CollaborationTaskListV1", new CollaborationTaskListV1(null, null).toSchema());
+      schemas.put("CollaborationAssignmentRequestV1", new CollaborationAssignmentRequestV1(null, null).toSchema());
+      schemas.put("CollaborationAssignmentV1", new CollaborationAssignmentV1(null, null, null, null, null).toSchema());
+      schemas.put("CollaborationMyWorkV1", new CollaborationMyWorkV1(null, null, null, null).toSchema());
+      return (schemas);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/CommentHistorySpec.java

@@ -0,0 +1,74 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationCommentHistoryV1;
+import com.kingsrook.qbits.collaboration.comments.CommentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Read comment edit history.
+ *******************************************************************************/
+public class CommentHistorySpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/comments/{id}/history", "Read comment edit history"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters("limit", "cursor"));
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationCommentHistoryV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var page = page(input, new CommentsService().history(id(input)));
+      return (new CollaborationCommentHistoryV1(page.items().stream().map(CollaborationViews::commentRevision).toList(), page.nextCursor()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/CreateAccessRequestSpec.java

@@ -0,0 +1,86 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+import java.util.List;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+/*******************************************************************************
+ ** CreateAccessRequest endpoint.
+ *******************************************************************************/
+public class CreateAccessRequestSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe this operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.POST, "/access-requests", "Request access to a record"));
+   }
+
+   /*******************************************************************************
+    ** Declare inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationAccessRequestV1");
+   }
+
+   /*******************************************************************************
+    ** Name the request.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationAccessRequestCreateRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Run the service as the authenticated caller.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationWorkSchemas.CollaborationAccessRequestCreateRequestV1.class);
+      if(body.shareId() != null && body.shareId() < 1)
+      {
+         throw (new com.kingsrook.qqq.backend.core.exceptions.QBadRequestException("shareId must be positive"));
+      }
+      return (CollaborationViews.accessRequest(new com.kingsrook.qbits.collaboration.sharing.AccessRequestService()
+         .request(required(body.tableName(), "tableName"), required(body.recordId(), "recordId"), body.message(), body.shareId())));
+   }
+
+}

src/main/java/com/kingsrook/qbits/collaboration/api/CreateSharesSpec.java

@@ -0,0 +1,82 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+import java.util.List;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+/*******************************************************************************
+ ** CreateShares endpoint.
+ *******************************************************************************/
+public class CreateSharesSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe this operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.POST, "/records/{table}/{pk}/shares", "Share a record"));
+   }
+
+   /*******************************************************************************
+    ** Declare inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationShareListV1");
+   }
+
+   /*******************************************************************************
+    ** Name the request.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationShareRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Run the service as the authenticated caller.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationWorkSchemas.CollaborationShareRequestV1.class);
+      return (new CollaborationWorkSchemas.CollaborationShareListV1(new com.kingsrook.qbits.collaboration.sharing.SharingService()
+         .share(table(input), pk(input), recipients(body.toUserIds()), body.message()).stream().map(CollaborationViews::share).toList()));
+   }
+
+}

src/main/java/com/kingsrook/qbits/collaboration/api/CreateTagSpec.java

@@ -0,0 +1,84 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationTagCreateRequestV1;
+import com.kingsrook.qbits.collaboration.tags.TagsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+
+/*******************************************************************************
+ ** Create or suggest a tag.
+ *******************************************************************************/
+public class CreateTagSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.POST, "/tags", "Create or suggest a tag"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationTagV1");
+   }
+
+   /*******************************************************************************
+    ** Name the versioned request body.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationTagCreateRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationTagCreateRequestV1.class);
+      return (CollaborationViews.tag(new TagsService().create(required(body.table(), "table"), body.label(), body.color())));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/CreateTaskSpec.java

@@ -0,0 +1,82 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+import java.util.List;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+/*******************************************************************************
+ ** CreateTask endpoint.
+ *******************************************************************************/
+public class CreateTaskSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe this operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.POST, "/records/{table}/{pk}/tasks", "Create a task"));
+   }
+
+   /*******************************************************************************
+    ** Declare inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationTaskV1");
+   }
+
+   /*******************************************************************************
+    ** Name the request.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationTaskCreateRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Run the service as the authenticated caller.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationWorkSchemas.CollaborationTaskCreateRequestV1.class);
+      return (CollaborationViews.task(new com.kingsrook.qbits.collaboration.tasks.TasksService().create(table(input), pk(input),
+         required(body.title(), "title"), body.notes(), body.assigneeUserId(), instant(body.dueAt()), instant(body.remindAt()))));
+   }
+
+}

src/main/java/com/kingsrook/qbits/collaboration/api/DeleteAttachmentSpec.java

@@ -0,0 +1,73 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Delete an attachment.
+ *******************************************************************************/
+public class DeleteAttachmentSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.DELETE, "/attachments/{id}", "Delete an attachment"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationMutationResultV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      new AttachmentsService().delete(List.of(id(input)));
+      return (success());
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/DeleteCommentSpec.java

@@ -0,0 +1,73 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.comments.CommentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Delete a comment thread.
+ *******************************************************************************/
+public class DeleteCommentSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.DELETE, "/comments/{id}", "Delete a comment thread"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationMutationResultV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      new CommentsService().delete(id(input));
+      return (success());
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/DeleteFollowSpec.java

@@ -0,0 +1,74 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationFollowStateV1;
+import com.kingsrook.qbits.collaboration.follow.FollowService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Unfollow a record.
+ *******************************************************************************/
+public class DeleteFollowSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.DELETE, "/records/{table}/{pk}/follow", "Unfollow a record"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationFollowStateV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      new FollowService().unfollow(table(input), pk(input));
+      return (new CollaborationFollowStateV1(false, null));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/DownloadAttachmentSpec.java

@@ -0,0 +1,73 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationDownloadV1;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Get a temporary download URL; clients follow url.
+ *******************************************************************************/
+public class DownloadAttachmentSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/attachments/{id}/download", "Get a temporary download URL; clients follow url"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationDownloadV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      return (new CollaborationDownloadV1(new AttachmentsService().downloadUrl(id(input), false).toExternalForm()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/EditCommentSpec.java

@@ -0,0 +1,84 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationCommentEditRequestV1;
+import com.kingsrook.qbits.collaboration.comments.CommentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+
+/*******************************************************************************
+ ** Edit the caller's comment.
+ *******************************************************************************/
+public class EditCommentSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.PATCH, "/comments/{id}", "Edit the caller's comment"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationCommentV1");
+   }
+
+   /*******************************************************************************
+    ** Name the versioned request body.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationCommentEditRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationCommentEditRequestV1.class);
+      return (CollaborationViews.comment(new CommentsService().edit(id(input), body.body())));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/GetFollowSpec.java

@@ -0,0 +1,74 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationFollowStateV1;
+import com.kingsrook.qbits.collaboration.follow.FollowService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Get the caller's follow state.
+ *******************************************************************************/
+public class GetFollowSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/records/{table}/{pk}/follow", "Get the caller's follow state"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationFollowStateV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var state = new FollowService().state(table(input), pk(input));
+      return (new CollaborationFollowStateV1(state.isPresent(), state.map(CollaborationViews::follow).orElse(null)));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/GetMyWorkSpec.java

@@ -0,0 +1,72 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+import java.util.List;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+/*******************************************************************************
+ ** GetMyWork endpoint.
+ *******************************************************************************/
+public class GetMyWorkSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe this operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/my-work", "Get my work summary"));
+   }
+
+   /*******************************************************************************
+    ** Declare inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationMyWorkV1");
+   }
+
+   /*******************************************************************************
+    ** Run the service as the authenticated caller.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var summary = new com.kingsrook.qbits.collaboration.mywork.MyWorkService().summary();
+      return (new CollaborationWorkSchemas.CollaborationMyWorkV1(summary.openTaskCount(), summary.tasks().stream().map(CollaborationViews::task).toList(),
+         summary.assignedRecordsByTable(), summary.unreadMentionCount()));
+   }
+
+}

src/main/java/com/kingsrook/qbits/collaboration/api/GetPersonSpec.java

@@ -0,0 +1,72 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.people.PeopleService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Get an active directory person.
+ *******************************************************************************/
+public class GetPersonSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/people/{userId}", "Get an active directory person"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationPersonV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      return (CollaborationViews.person(new PeopleService().get(input.getPathParam("userId"))));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/GetRecordLinkSpec.java

@@ -0,0 +1,71 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+import java.util.List;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+/*******************************************************************************
+ ** GetRecordLink endpoint.
+ *******************************************************************************/
+public class GetRecordLinkSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe this operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/records/{table}/{pk}/link", "Get a record link"));
+   }
+
+   /*******************************************************************************
+    ** Declare inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationLinkV1");
+   }
+
+   /*******************************************************************************
+    ** Run the service as the authenticated caller.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var link = new com.kingsrook.qbits.collaboration.sharing.SharingService().link(table(input), pk(input));
+      return (new CollaborationWorkSchemas.CollaborationLinkV1(link.url(), link.label()));
+   }
+
+}

src/main/java/com/kingsrook/qbits/collaboration/api/GetTimelineSpec.java

@@ -0,0 +1,74 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationTimelinePageV1;
+import com.kingsrook.qbits.collaboration.timeline.TimelineService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Page the merged record timeline.
+ *******************************************************************************/
+public class GetTimelineSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/records/{table}/{pk}/timeline", "Page the merged record timeline"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters("before", "types", "limit", "cursor"));
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationTimelinePageV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var page = new TimelineService().timeline(table(input), pk(input), timelineCursor(input), limit(input), types(input));
+      return (new CollaborationTimelinePageV1(page.items().stream().map(CollaborationViews::timelineItem).toList(), page.nextCursor()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/ListAttachmentsSpec.java

@@ -0,0 +1,74 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationAttachmentListV1;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** List record attachments.
+ *******************************************************************************/
+public class ListAttachmentsSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/records/{table}/{pk}/attachments", "List record attachments"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters("limit", "cursor"));
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationAttachmentListV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var page = page(input, new AttachmentsService().list(table(input), pk(input)));
+      return (new CollaborationAttachmentListV1(page.items().stream().map(CollaborationViews::attachment).toList(), page.nextCursor()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/ListCommentsSpec.java

@@ -0,0 +1,74 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationCommentPageV1;
+import com.kingsrook.qbits.collaboration.comments.CommentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Page record comment threads.
+ *******************************************************************************/
+public class ListCommentsSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/records/{table}/{pk}/comments", "Page record comment threads"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters("limit", "cursor"));
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationCommentPageV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var page = new CommentsService().list(table(input), pk(input), input.getQueryParam("cursor"), limit(input));
+      return (new CollaborationCommentPageV1(page.threads().stream().map(CollaborationViews::comment).toList(), page.nextCursor()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/ListFavoritesSpec.java

@@ -0,0 +1,86 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationFavoriteListV1;
+import com.kingsrook.qbits.collaboration.favorites.FavoritesService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+
+/*******************************************************************************
+ ** List personal favorites.
+ *******************************************************************************/
+public class ListFavoritesSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** The extension's first spec publishes the shared schema catalog exactly once.
+    ** QQQ collects components across specs and warns on every duplicate name.
+    *******************************************************************************/
+   @Override
+   public Map<String, Schema> defineComponentSchemas()
+   {
+      return (CollaborationSchemas.components());
+   }
+
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/favorites", "List personal favorites"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters("limit", "cursor"));
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationFavoriteListV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var page = page(input, FavoritesService.list());
+      return (new CollaborationFavoriteListV1(page.items().stream().map(CollaborationViews::favorite).toList(), page.nextCursor()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/ListFollowersSpec.java

@@ -0,0 +1,74 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationFollowerListV1;
+import com.kingsrook.qbits.collaboration.follow.FollowService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** List record followers.
+ *******************************************************************************/
+public class ListFollowersSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/records/{table}/{pk}/followers", "List record followers"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters("limit", "cursor"));
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationFollowerListV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var page = page(input, new FollowService().followers(table(input), pk(input)));
+      return (new CollaborationFollowerListV1(page.items().stream().map(CollaborationViews::follow).toList(), page.nextCursor()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/ListMyAccessRequestsSpec.java

@@ -0,0 +1,72 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+import java.util.List;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+/*******************************************************************************
+ ** ListMyAccessRequests endpoint.
+ *******************************************************************************/
+public class ListMyAccessRequestsSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe this operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/access-requests/mine", "List my access requests"));
+   }
+
+   /*******************************************************************************
+    ** Declare inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters("limit", "cursor"));
+   }
+
+   /*******************************************************************************
+    ** Name the response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationAccessRequestListV1");
+   }
+
+   /*******************************************************************************
+    ** Run the service as the authenticated caller.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var values = new com.kingsrook.qbits.collaboration.sharing.AccessRequestService().mine();
+      var page = page(input, values);
+      return (new CollaborationWorkSchemas.CollaborationAccessRequestListV1(page.items().stream().map(CollaborationViews::accessRequest).toList(), page.nextCursor()));
+   }
+
+}

src/main/java/com/kingsrook/qbits/collaboration/api/ListMyTasksSpec.java

@@ -0,0 +1,71 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+import java.util.List;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+/*******************************************************************************
+ ** ListMyTasks endpoint.
+ *******************************************************************************/
+public class ListMyTasksSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe this operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/tasks/mine", "List my tasks"));
+   }
+
+   /*******************************************************************************
+    ** Declare inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters("status", "limit", "cursor"));
+   }
+
+   /*******************************************************************************
+    ** Name the response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationTaskListV1");
+   }
+
+   /*******************************************************************************
+    ** Run the service as the authenticated caller.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var page = new com.kingsrook.qbits.collaboration.tasks.TasksService().mine(input.getQueryParam("status"), limit(input), input.getQueryParam("cursor"));
+      return (new CollaborationWorkSchemas.CollaborationTaskListV1(page.tasks().stream().map(CollaborationViews::task).toList(), page.nextCursor()));
+   }
+
+}

src/main/java/com/kingsrook/qbits/collaboration/api/ListPeopleSpec.java

@@ -0,0 +1,74 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationPersonListV1;
+import com.kingsrook.qbits.collaboration.people.PeopleService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Search the active people directory.
+ *******************************************************************************/
+public class ListPeopleSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/people", "Search the active people directory"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters("q", "limit"));
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationPersonListV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      new PeopleService().touch();
+      return (new CollaborationPersonListV1(new PeopleService().search(input.getQueryParam("q"), limit(input)).stream().map(CollaborationViews::person).toList(), null));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/ListRecentsSpec.java

@@ -0,0 +1,74 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationRecentListV1;
+import com.kingsrook.qbits.collaboration.recents.RecentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** List recent targets.
+ *******************************************************************************/
+public class ListRecentsSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/recents", "List recent targets"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters("limit", "cursor"));
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationRecentListV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var page = page(input, RecentsService.list(50));
+      return (new CollaborationRecentListV1(page.items().stream().map(CollaborationViews::favorite).toList(), page.nextCursor()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/ListRecordTagsSpec.java

@@ -0,0 +1,74 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationTagListV1;
+import com.kingsrook.qbits.collaboration.tags.TagsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** List applied record tags.
+ *******************************************************************************/
+public class ListRecordTagsSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/records/{table}/{pk}/tags", "List applied record tags"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters("limit", "cursor"));
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationTagListV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var page = page(input, new TagsService().tagsFor(table(input), pk(input)));
+      return (new CollaborationTagListV1(page.items().stream().map(CollaborationViews::tag).toList(), page.nextCursor()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/ListTagsSpec.java

@@ -0,0 +1,73 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationTagListV1;
+import com.kingsrook.qbits.collaboration.tags.TagsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Search table tag vocabulary.
+ *******************************************************************************/
+public class ListTagsSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/tags", "Search table tag vocabulary"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters("table!", "q", "limit"));
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationTagListV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      return (new CollaborationTagListV1(new TagsService().vocabulary(required(input.getQueryParam("table"), "table"), input.getQueryParam("q"), limit(input)).stream().map(CollaborationViews::tag).toList(), null));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/ListTasksSpec.java

@@ -0,0 +1,76 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+import java.util.List;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+/*******************************************************************************
+ ** ListTasks endpoint.
+ *******************************************************************************/
+public class ListTasksSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe this operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/records/{table}/{pk}/tasks", "List record tasks"));
+   }
+
+   /*******************************************************************************
+    ** Declare inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters("includeDone", "limit", "cursor"));
+   }
+
+   /*******************************************************************************
+    ** Name the response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationTaskListV1");
+   }
+
+   /*******************************************************************************
+    ** Run the service as the authenticated caller.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      String includeDone = input.getQueryParam("includeDone");
+      if(includeDone != null && !List.of("true", "false").contains(includeDone))
+      {
+         throw (new com.kingsrook.qqq.backend.core.exceptions.QBadRequestException("includeDone must be true or false"));
+      }
+      var page = page(input, new com.kingsrook.qbits.collaboration.tasks.TasksService().list(table(input), pk(input), Boolean.valueOf(includeDone)));
+      return (new CollaborationWorkSchemas.CollaborationTaskListV1(page.items().stream().map(CollaborationViews::task).toList(), page.nextCursor()));
+   }
+
+}

src/main/java/com/kingsrook/qbits/collaboration/api/MentionCandidatesSpec.java

@@ -0,0 +1,74 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationMentionCandidateListV1;
+import com.kingsrook.qbits.collaboration.comments.CommentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Find people to mention on a record.
+ *******************************************************************************/
+public class MentionCandidatesSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/mentions/candidates", "Find people to mention on a record"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters("table!", "pk!", "q", "limit", "cursor"));
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationMentionCandidateListV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var page = page(input, new CommentsService().mentionCandidates(required(input.getQueryParam("table"), "table"), required(input.getQueryParam("pk"), "pk"), input.getQueryParam("q")));
+      return (new CollaborationMentionCandidateListV1(page.items().stream().map(CollaborationViews::mentionCandidate).toList(), page.nextCursor()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/OrderFavoritesSpec.java

@@ -0,0 +1,85 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationFavoriteOrderRequestV1;
+import com.kingsrook.qbits.collaboration.favorites.FavoritesService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+
+/*******************************************************************************
+ ** Reorder personal favorites.
+ *******************************************************************************/
+public class OrderFavoritesSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.PATCH, "/favorites/order", "Reorder personal favorites"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationMutationResultV1");
+   }
+
+   /*******************************************************************************
+    ** Name the versioned request body.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationFavoriteOrderRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationFavoriteOrderRequestV1.class);
+      FavoritesService.reorder(body.ids(), folders(body.folders()));
+      return (success());
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/PatchAttachmentSpec.java

@@ -0,0 +1,84 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationAttachmentPatchRequestV1;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+
+/*******************************************************************************
+ ** Rename or describe an attachment.
+ *******************************************************************************/
+public class PatchAttachmentSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.PATCH, "/attachments/{id}", "Rename or describe an attachment"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationAttachmentV1");
+   }
+
+   /*******************************************************************************
+    ** Name the versioned request body.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationAttachmentPatchRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationAttachmentPatchRequestV1.class);
+      return (CollaborationViews.attachment(new AttachmentsService().rename(id(input), body.fileName(), body.description())));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/PatchTaskSpec.java

@@ -0,0 +1,128 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+import java.util.List;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+/*******************************************************************************
+ ** PatchTask endpoint.
+ *******************************************************************************/
+public class PatchTaskSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Check the stored parent before parsing any submitted body.
+    *******************************************************************************/
+   @Override
+   public JsonInput buildInput(io.javalin.http.Context context) throws Exception
+   {
+      try
+      {
+         Integer key = Integer.valueOf(context.pathParam("id"));
+         if(key < 1)
+         {
+            throw (new NumberFormatException());
+         }
+         new com.kingsrook.qbits.collaboration.tasks.TasksService().requireManager(key);
+      }
+      catch(NumberFormatException e)
+      {
+         throw (new com.kingsrook.qqq.backend.core.exceptions.QBadRequestException("An identifier must be a positive integer"));
+      }
+      return (super.buildInput(context));
+   }
+
+   /*******************************************************************************
+    ** Describe this operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.PATCH, "/tasks/{id}", "Update a task"));
+   }
+
+   /*******************************************************************************
+    ** Declare inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationTaskV1");
+   }
+
+   /*******************************************************************************
+    ** Name the request.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationTaskPatchRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Run the service as the authenticated caller.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var service = new com.kingsrook.qbits.collaboration.tasks.TasksService();
+      var old = service.requireManager(id(input));
+      var body = body(input, CollaborationWorkSchemas.CollaborationTaskPatchRequestV1.class);
+      String status = body.status();
+      if(input.getBody().containsKey("status") && (status == null || !List.of("OPEN", "DONE", "CANCELLED").contains(status)))
+      {
+         throw (new com.kingsrook.qqq.backend.core.exceptions.QBadRequestException("Unknown task status"));
+      }
+      var row = old;
+      if(input.getBody().keySet().stream().anyMatch(key -> !key.equals("status")))
+      {
+         row = service.update(id(input), input.getBody().containsKey("title") ? required(body.title(), "title") : old.getValueString("title"),
+            input.getBody().containsKey("notes") ? body.notes() : old.getValueString("notes"),
+            input.getBody().containsKey("assigneeUserId") ? body.assigneeUserId() : old.getValueString("assigneeUserId"),
+            input.getBody().containsKey("dueAt") ? instant(body.dueAt()) : old.getValueInstant("dueAt"),
+            input.getBody().containsKey("remindAt") ? instant(body.remindAt()) : old.getValueInstant("remindAt"));
+      }
+      if(status != null)
+      {
+         row = switch(status)
+         {
+            case "DONE" -> service.complete(id(input));
+            case "CANCELLED" -> service.cancel(id(input));
+            default -> service.reopen(id(input));
+         };
+      }
+      return (CollaborationViews.task(row));
+   }
+
+}

src/main/java/com/kingsrook/qbits/collaboration/api/PostCommentSpec.java

@@ -0,0 +1,84 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationCommentPostRequestV1;
+import com.kingsrook.qbits.collaboration.comments.CommentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+
+/*******************************************************************************
+ ** Post a comment or reply.
+ *******************************************************************************/
+public class PostCommentSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.POST, "/records/{table}/{pk}/comments", "Post a comment or reply"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationCommentV1");
+   }
+
+   /*******************************************************************************
+    ** Name the versioned request body.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationCommentPostRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationCommentPostRequestV1.class);
+      return (CollaborationViews.comment(new CommentsService().post(table(input), pk(input), body.body(), body.parentCommentId(), body.fieldName())));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/PreviewAttachmentSpec.java

@@ -0,0 +1,73 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationDownloadV1;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Get a temporary preview URL; clients follow url.
+ *******************************************************************************/
+public class PreviewAttachmentSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.GET, "/attachments/{id}/preview", "Get a temporary preview URL; clients follow url"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationDownloadV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      return (new CollaborationDownloadV1(new AttachmentsService().downloadUrl(id(input), true).toExternalForm()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/PreviewSharesSpec.java

@@ -0,0 +1,83 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+import java.util.List;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+/*******************************************************************************
+ ** PreviewShares endpoint.
+ *******************************************************************************/
+public class PreviewSharesSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe this operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.POST, "/records/{table}/{pk}/shares/preview", "Preview share recipients"));
+   }
+
+   /*******************************************************************************
+    ** Declare inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationSharePreviewV1");
+   }
+
+   /*******************************************************************************
+    ** Name the request.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationShareRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Run the service as the authenticated caller.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationWorkSchemas.CollaborationShareRequestV1.class);
+      var values = new com.kingsrook.qbits.collaboration.sharing.SharingService().preview(table(input), pk(input), recipients(body.toUserIds()));
+      return (new CollaborationWorkSchemas.CollaborationSharePreviewV1(values.stream()
+         .map(value -> new CollaborationWorkSchemas.CollaborationShareRecipientV1(value.userId(), value.displayName(), value.canRead())).toList()));
+   }
+
+}

src/main/java/com/kingsrook/qbits/collaboration/api/PutAssignmentSpec.java

@@ -0,0 +1,82 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+import java.util.List;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+/*******************************************************************************
+ ** PutAssignment endpoint.
+ *******************************************************************************/
+public class PutAssignmentSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe this operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.PUT, "/records/{table}/{pk}/assignment", "Set record owner and assignee"));
+   }
+
+   /*******************************************************************************
+    ** Declare inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationAssignmentV1");
+   }
+
+   /*******************************************************************************
+    ** Name the request.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationAssignmentRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Run the service as the authenticated caller.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationWorkSchemas.CollaborationAssignmentRequestV1.class);
+      return (CollaborationViews.assignment(new com.kingsrook.qbits.collaboration.assignment.AssignmentService()
+         .assign(table(input), pk(input), body.ownerUserId(), body.assigneeUserId())));
+   }
+
+}

src/main/java/com/kingsrook/qbits/collaboration/api/PutFollowSpec.java

@@ -0,0 +1,85 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationFollowRequestV1;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationFollowStateV1;
+import com.kingsrook.qbits.collaboration.follow.FollowService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+
+/*******************************************************************************
+ ** Follow a record and configure notifications.
+ *******************************************************************************/
+public class PutFollowSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.PUT, "/records/{table}/{pk}/follow", "Follow a record and configure notifications"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationFollowStateV1");
+   }
+
+   /*******************************************************************************
+    ** Name the versioned request body.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationFollowRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationFollowRequestV1.class);
+      return (new CollaborationFollowStateV1(true, CollaborationViews.follow(new FollowService().follow(table(input), pk(input), body.notifyOnChange(), body.notifyOnComment()))));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/RecordRecentSpec.java

@@ -0,0 +1,85 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationTargetRequestV1;
+import com.kingsrook.qbits.collaboration.recents.RecentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+
+/*******************************************************************************
+ ** Record a recent view.
+ *******************************************************************************/
+public class RecordRecentSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.POST, "/recents", "Record a recent view"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationMutationResultV1");
+   }
+
+   /*******************************************************************************
+    ** Name the versioned request body.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationTargetRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationTargetRequestV1.class);
+      RecentsService.recordView(body.targetType(), body.targetName(), body.recordId());
+      return (success());
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/ReopenCommentSpec.java

@@ -0,0 +1,73 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.comments.CommentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Reopen a comment thread.
+ *******************************************************************************/
+public class ReopenCommentSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.POST, "/comments/{id}/reopen", "Reopen a comment thread"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationMutationResultV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      new CommentsService().reopen(id(input));
+      return (success());
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/ResolveCommentSpec.java

@@ -0,0 +1,73 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.comments.CommentsService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+
+
+/*******************************************************************************
+ ** Resolve a comment thread.
+ *******************************************************************************/
+public class ResolveCommentSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.POST, "/comments/{id}/resolve", "Resolve a comment thread"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationMutationResultV1");
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      new CommentsService().resolve(id(input));
+      return (success());
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/StarFavoriteSpec.java

@@ -0,0 +1,85 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationTargetRequestV1;
+import com.kingsrook.qbits.collaboration.favorites.FavoritesService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+
+/*******************************************************************************
+ ** Star a target.
+ *******************************************************************************/
+public class StarFavoriteSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.PUT, "/favorites", "Star a target"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationMutationResultV1");
+   }
+
+   /*******************************************************************************
+    ** Name the versioned request body.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationTargetRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationTargetRequestV1.class);
+      FavoritesService.star(body.targetType(), body.targetName(), body.recordId());
+      return (success());
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/UnstarFavoriteSpec.java

@@ -0,0 +1,85 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationTargetRequestV1;
+import com.kingsrook.qbits.collaboration.favorites.FavoritesService;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+
+
+/*******************************************************************************
+ ** Unstar a target.
+ *******************************************************************************/
+public class UnstarFavoriteSpec extends CollaborationJsonSpec
+{
+   /*******************************************************************************
+    ** Describe the operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (operation(HttpMethod.DELETE, "/favorites", "Unstar a target"));
+   }
+
+   /*******************************************************************************
+    ** Describe path and query inputs.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (parameters());
+   }
+
+   /*******************************************************************************
+    ** Name the versioned response.
+    *******************************************************************************/
+   @Override
+   protected String getResponseSchemaName()
+   {
+      return ("CollaborationMutationResultV1");
+   }
+
+   /*******************************************************************************
+    ** Name the versioned request body.
+    *******************************************************************************/
+   @Override
+   protected Schema defineRequestBodySchema()
+   {
+      return (new Schema().withRefToSchema("CollaborationTargetRequestV1"));
+   }
+
+   /*******************************************************************************
+    ** Invoke the service with the authenticated caller's context.
+    *******************************************************************************/
+   @Override
+   protected Object handle(JsonInput input) throws Exception
+   {
+      var body = body(input, CollaborationTargetRequestV1.class);
+      FavoritesService.unstar(body.targetType(), body.targetName(), body.recordId());
+      return (success());
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/api/UploadAttachmentSpec.java

@@ -0,0 +1,186 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.api;
+
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.kingsrook.qbits.collaboration.api.CollaborationSchemas.CollaborationAttachmentV1;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentsService;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+import com.kingsrook.qqq.middleware.javalin.executors.AbstractMiddlewareExecutor;
+import com.kingsrook.qqq.middleware.javalin.executors.io.AbstractMiddlewareInput;
+import com.kingsrook.qqq.middleware.javalin.executors.io.AbstractMiddlewareOutputInterface;
+import com.kingsrook.qqq.middleware.javalin.specs.AbstractEndpointSpec;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicResponse;
+import com.kingsrook.qqq.openapi.model.Content;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.RequestBody;
+import com.kingsrook.qqq.openapi.model.Schema;
+import io.javalin.http.Context;
+import io.javalin.http.UploadedFile;
+
+
+/*******************************************************************************
+ ** Multipart adapter: exactly one file, streamed through the bounded attachment service.
+ *******************************************************************************/
+public class UploadAttachmentSpec extends AbstractEndpointSpec<UploadAttachmentSpec.UploadInput, UploadAttachmentSpec.UploadOutput, UploadAttachmentSpec.UploadExecutor>
+{
+   /*******************************************************************************
+    ** Describe the upload operation.
+    *******************************************************************************/
+   @Override
+   public BasicOperation defineBasicOperation()
+   {
+      return (CollaborationJsonSpec.operation(HttpMethod.POST, "/records/{table}/{pk}/attachments", "Upload an attachment"));
+   }
+
+   /*******************************************************************************
+    ** Parent coordinates.
+    *******************************************************************************/
+   @Override
+   public List<Parameter> defineRequestParameters()
+   {
+      return (CollaborationJsonSpec.parametersFor(defineBasicOperation().getPath()));
+   }
+
+   /*******************************************************************************
+    ** A named binary file and optional description, not a JSON upload.
+    *******************************************************************************/
+   @Override
+   public RequestBody defineRequestBody()
+   {
+      return (new RequestBody().withRequired(true).withContent(Map.of("multipart/form-data",
+         new Content().withSchema(new Schema().withRefToSchema("CollaborationAttachmentUploadRequestV1")))));
+   }
+
+   /*******************************************************************************
+    ** Use the same typed attachment as JSON operations.
+    *******************************************************************************/
+   @Override
+   public BasicResponse defineBasicSuccessResponse()
+   {
+      return (new BasicResponse("Uploaded attachment", "CollaborationAttachmentV1"));
+   }
+
+   /*******************************************************************************
+    ** Standard framework errors.
+    *******************************************************************************/
+   @Override
+   public List<BasicResponse> defineAdditionalBasicResponses()
+   {
+      return (CollaborationJsonSpec.errors());
+   }
+
+   /*******************************************************************************
+    ** Authenticate and check the parent before asking Javalin for uploaded parts.
+    *******************************************************************************/
+   @Override
+   public UploadInput buildInput(Context context) throws Exception
+   {
+      ParentRecordAccess.requireFeature(context.pathParam("table"), context.pathParam("pk"), "attach");
+      if(context.contentType() == null || !context.contentType().toLowerCase(Locale.ROOT).startsWith("multipart/form-data"))
+      {
+         throw (new QBadRequestException("Use multipart/form-data with one file part named file"));
+      }
+      List<UploadedFile> files;
+      try
+      {
+         files = context.uploadedFiles();
+      }
+      catch(RuntimeException e)
+      {
+         throw (new QBadRequestException("Malformed multipart upload", e));
+      }
+      if(files.size() != 1 || context.uploadedFiles("file").size() != 1)
+      {
+         throw (new QBadRequestException("Exactly one file part named file is required"));
+      }
+      UploadInput input = new UploadInput();
+      input.table = context.pathParam("table");
+      input.pk = context.pathParam("pk");
+      input.file = files.getFirst();
+      input.description = context.formParam("description");
+      return (input);
+   }
+
+   /*******************************************************************************
+    ** Serialize the wire record, keeping nullable display fields.
+    *******************************************************************************/
+   @Override
+   public void handleOutput(Context context, UploadOutput output)
+   {
+      context.contentType("application/json").result(JsonUtils.toJsonCustomized(output.attachment,
+         builder -> builder.serializationInclusion(JsonInclude.Include.ALWAYS)));
+   }
+
+   /*******************************************************************************
+    ** Request parts remain scoped to this request.
+    *******************************************************************************/
+   public static class UploadInput extends AbstractMiddlewareInput
+   {
+      private String table;
+      private String pk;
+      private UploadedFile file;
+      private String description;
+   }
+
+   /*******************************************************************************
+    ** The executor output contains only the public wire DTO.
+    *******************************************************************************/
+   public static class UploadOutput implements AbstractMiddlewareOutputInterface
+   {
+      private CollaborationAttachmentV1 attachment;
+   }
+
+   /*******************************************************************************
+    ** The service enforces size, filename policy, permission, storage and cleanup.
+    *******************************************************************************/
+   public static class UploadExecutor extends AbstractMiddlewareExecutor<UploadInput, UploadOutput>
+   {
+      /*******************************************************************************
+       ** Close the uploaded stream after the synchronous service call.
+       *******************************************************************************/
+      @Override
+      public void execute(UploadInput input, UploadOutput output) throws QException
+      {
+         try(InputStream stream = input.file.content())
+         {
+            output.attachment = CollaborationViews.attachment(new AttachmentsService().upload(input.table, input.pk,
+               input.file.filename(), input.file.contentType(), stream, input.description));
+         }
+         catch(IOException e)
+         {
+            throw (new QException("Could not read attachment upload", e));
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/app/CollaborationHome.java

@@ -125,7 +125,7 @@ public final class CollaborationHome
                .withCriteria(new QFilterCriteria("enabled", QCriteriaOperator.EQUALS, true)));
             html.append("<li>").append(scope).append(": ").append(enabled).append("</li>");
          }
-         html.append("</ul><p>Stored overrides; applying them awaits the core collaboration contracts.</p>");
+         html.append("</ul><p>Feature settings take effect after saving.</p>");
       }
       long people = count(CollaborationTables.USER, new QQueryFilter());
       long recent = count(CollaborationTables.USER, new QQueryFilter()

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentCleanup.java

@@ -65,7 +65,7 @@ public class AttachmentCleanup
       new com.kingsrook.qbits.collaboration.tags.TagsService().onParentsDeleted(table, ids);
       while(true)
       {
-         List<QRecord> rows = AttachmentRecords.query(new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table)
+         List<QRecord> rows = com.kingsrook.qbits.collaboration.CollaborationRecords.cleanupQuery(com.kingsrook.qbits.collaboration.model.CollaborationTables.ATTACHMENT, new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table)
             .withCriteria("recordId", QCriteriaOperator.IN, ids.stream().map(Object::toString).toList()).withLimit(200));
          if(rows.isEmpty())
          {
@@ -73,7 +73,7 @@ public class AttachmentCleanup
          }
          for(QRecord row : rows)
          {
-            service.deleteStoredRow(row);
+            service.deleteStoredRow(row, true);
          }
       }
    }

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentRecords.java

@@ -49,7 +49,7 @@ final class AttachmentRecords
     *******************************************************************************/
    static List<QRecord> query(QQueryFilter filter) throws QException
    {
-      QueryInput input = new QueryInput(CollaborationTables.ATTACHMENT).withFilter(filter).withShouldFetchHeavyFields(true);
+      QueryInput input = new QueryInput(CollaborationTables.ATTACHMENT).withFilter(filter).withShouldFetchHeavyFields(true).withTransaction(QContext.getQBackendTransaction());
       input.setTableMetaData(storageTable());
       input.withPermissionBypass("Attachment service checks parent access; cleanup is a trusted after-delete callback.");
       return (new QueryAction().execute(input).getRecords());

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentSecurity.java

@@ -25,16 +25,13 @@ import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissionChec
 import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
 import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
 import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
-import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrCountInputInterface;
 import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
 import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
 import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
 import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
 
 /*******************************************************************************
- ** RC.5 has no PRE_QUERY customizer. Its permission checker provides the
- ** pre-query restriction for query, count and aggregate; post-query checks
- ** handle parent record locks. Direct writes must use the attachment service.
+ ** Core reference metadata protects reads; direct writes use the attachment service.
  *******************************************************************************/
 public class AttachmentSecurity implements CustomPermissionChecker
 {
@@ -49,18 +46,5 @@ public class AttachmentSecurity implements CustomPermissionChecker
          throw (new QPermissionDeniedException("Use the attachment service or Delete attachments action."));
       }
       new CollaborationPermissionChecker().checkPermissionsThrowing(input, metadata);
-      if(input instanceof QueryOrCountInputInterface query)
-      {
-         restrict(query);
-      }
-   }
-
-   /*******************************************************************************
-    ** AND the restriction outside any user OR clauses; preserve paging and sort.
-    ** Counts and aggregates are approximate because parent locks are post-filtered.
-    *******************************************************************************/
-   public static void restrict(QueryOrCountInputInterface input)
-   {
-      com.kingsrook.qbits.collaboration.security.ParentTableRestriction.restrict(input);
    }
 }

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentsService.java

@@ -49,6 +49,7 @@ import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
 import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
 import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
 import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
 import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
@@ -73,8 +74,9 @@ public class AttachmentsService
     *******************************************************************************/
    public AttachmentsService()
    {
-      this((CollaborationQBitConfig) QContext.getQInstance().getQBits().values().stream()
-         .filter(qbit -> qbit.getConfig() instanceof CollaborationQBitConfig).findFirst().orElseThrow().getConfig(), new AttachmentStorage());
+      this.config = (CollaborationQBitConfig) QContext.getQInstance().getQBits().values().stream()
+         .filter(qbit -> qbit.getConfig() instanceof CollaborationQBitConfig).findFirst().orElseThrow().getConfig();
+      this.storage = com.kingsrook.qqq.backend.core.actions.customizers.QCodeLoader.getAdHoc(AttachmentStorage.class, config.getAttachmentStorage());
    }
 
    /*******************************************************************************
@@ -102,7 +104,7 @@ public class AttachmentsService
       if(tableName.length() > 128 || id.length() > 64 || user.length() > 255 || bucket.length() > 255 || key.length() > 1024
          || (contentType != null && contentType.length() > 255))
       {
-         throw (new QException("Attachment metadata exceeds the supported field lengths."));
+         throw (new QBadRequestException("Attachment metadata exceeds the supported field lengths."));
       }
       long limit = Math.min(config.getDefaultMaxBytes(), storage.maxBytes(bucket));
       Path temporary = null;
@@ -119,7 +121,7 @@ public class AttachmentsService
             {
                if(read > limit - size)
                {
-                  throw (new QException("Attachment exceeds the size limit of " + limit + " bytes."));
+                  throw (new QBadRequestException("Attachment exceeds the size limit of " + limit + " bytes."));
                }
                size += read;
                digest.update(buffer, 0, read);
@@ -138,7 +140,7 @@ public class AttachmentsService
                .withValue("contentType", type).withValue("sizeBytes", size).withValue("sha256", HexFormat.of().formatHex(digest.digest()))
                .withValue("bucketName", bucket).withValue("storageKey", key).withValue("description", description)
                .withValue("createdByUserId", user).withValue("parentDeleted", false);
-            InsertInput input = new InsertInput(CollaborationTables.ATTACHMENT).withRecords(List.of(row));
+            InsertInput input = new InsertInput(CollaborationTables.ATTACHMENT).withTransaction(QContext.getQBackendTransaction()).withRecords(List.of(row));
             input.withPermissionBypass("AttachmentsService checked parent and attach permission before upload.");
             List<QRecord> records = new InsertAction().execute(input).getRecords();
             AttachmentRecords.checkErrors(records);
@@ -257,7 +259,7 @@ public class AttachmentsService
       {
          change.setValue("description", description);
       }
-      UpdateInput input = new UpdateInput(CollaborationTables.ATTACHMENT).withRecords(List.of(change));
+      UpdateInput input = new UpdateInput(CollaborationTables.ATTACHMENT).withTransaction(QContext.getQBackendTransaction()).withRecords(List.of(change));
       input.setTableMetaData(AttachmentRecords.storageTable());
       input.withPermissionBypass("AttachmentsService checked the actual parent and author/admin before metadata update.");
       AttachmentRecords.checkErrors(new UpdateAction().execute(input).getRecords());
@@ -284,10 +286,7 @@ public class AttachmentsService
       {
          throw (new QPermissionDeniedException("Only the author or collaboration.admin can change this attachment."));
       }
-      if(!isAdmin())
-      {
-         ParentRecordAccess.requireFeature(row.getValueString("tableName"), row.getValueString("recordId"), "attach");
-      }
+      ParentRecordAccess.requireFeature(row.getValueString("tableName"), row.getValueString("recordId"), "attach");
       return (row);
    }
 
@@ -295,10 +294,18 @@ public class AttachmentsService
     ** Delete storage first so a provider failure leaves a retryable row.
     *******************************************************************************/
    void deleteStoredRow(QRecord row) throws QException
+   {
+      deleteStoredRow(row, false);
+   }
+
+   /*******************************************************************************
+    ** Core cleanup supplies an already deleted parent; user deletion retains checks.
+    *******************************************************************************/
+   void deleteStoredRow(QRecord row, boolean cleanup) throws QException
    {
       storage.delete(row.getValueString("bucketName"), row.getValueString("storageKey"));
-      DeleteInput input = new DeleteInput(CollaborationTables.ATTACHMENT).withPrimaryKeys(List.of(row.getValue("id")));
-      input.setTableMetaData(AttachmentRecords.storageTable());
+      DeleteInput input = new DeleteInput(CollaborationTables.ATTACHMENT).withTransaction(QContext.getQBackendTransaction()).withPrimaryKeys(List.of(row.getValue("id")));
+      input.setTableMetaData(cleanup ? com.kingsrook.qbits.collaboration.CollaborationRecords.cleanupMetadata(CollaborationTables.ATTACHMENT) : AttachmentRecords.storageTable());
       input.withPermissionBypass("Attachment service authorized deletion, or trusted parent cleanup selected this row.");
       AttachmentRecords.checkErrors(new DeleteAction().execute(input).getRecordsWithErrors());
    }
@@ -373,18 +380,18 @@ public class AttachmentsService
    {
       if(fileName == null || fileName.isBlank())
       {
-         throw (new QException("A file name is required."));
+         throw (new QBadRequestException("A file name is required."));
       }
       String name = fileName.replace('\\', '/');
       name = name.substring(name.lastIndexOf('/') + 1).replaceAll("[^A-Za-z0-9._ -]", "_").strip();
       if(name.isBlank() || name.equals(".") || name.equals("..") || name.length() > 255)
       {
-         throw (new QException("Invalid file name."));
+         throw (new QBadRequestException("Invalid file name."));
       }
       String extension = name.substring(name.lastIndexOf('.') + 1).toLowerCase(Locale.ROOT);
       if(config.getBlockedExtensions().stream().anyMatch(blocked -> extension.equals(blocked.replaceFirst("^\\.", "").toLowerCase(Locale.ROOT))))
       {
-         throw (new QException("This file extension is blocked."));
+         throw (new QBadRequestException("This file extension is blocked."));
       }
       return (name);
    }

src/main/java/com/kingsrook/qbits/collaboration/comments/CommentsService.java

@@ -42,9 +42,10 @@ import com.kingsrook.qbits.collaboration.notify.Notifications;
 import com.kingsrook.qbits.collaboration.people.PeopleService;
 import com.kingsrook.qbits.collaboration.people.PersonEntry;
 import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
-import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qbits.collaboration.security.CollaborationRecordAccessChecker;
 import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
 import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
 import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
@@ -81,7 +82,7 @@ public class CommentsService
       }
       if(fieldName != null && !QContext.getQInstance().getTable(table).getFields().containsKey(fieldName))
       {
-         throw (new QException("Unknown field"));
+         throw (new QBadRequestException("Unknown field"));
       }
       Instant now = Instant.now();
       QRecord row = CollaborationRecords.insert(CollaborationTables.COMMENT, reference(table, id).withValue("body", body)
@@ -106,7 +107,7 @@ public class CommentsService
       RecordCursor before = cursor == null ? null : RecordCursor.decode(cursor);
       if(before != null && !before.kind().equals("COMMENT"))
       {
-         throw (new QException("Invalid comment cursor"));
+         throw (new QBadRequestException("Invalid comment cursor"));
       }
       QQueryFilter filter = CollaborationRecords.parent(table, id).withCriteria("threadId", QCriteriaOperator.IS_BLANK)
          .withOrderBy(new QFilterOrderBy("lastActivityAt", false)).withOrderBy(new QFilterOrderBy("id", false));
@@ -197,7 +198,7 @@ public class CommentsService
       requireCommentFeature(row);
       if(row.getValue("threadId") != null)
       {
-         throw (new QException("Resolve or reopen the root comment."));
+         throw (new QBadRequestException("Resolve or reopen the root comment."));
       }
       Instant now = Instant.now();
       CollaborationRecords.update(CollaborationTables.COMMENT, new QRecord().withValue("id", row.getValue("id"))
@@ -232,7 +233,7 @@ public class CommentsService
       List<MentionCandidate> result = new ArrayList<>();
       for(PersonEntry person : people)
       {
-         result.add(new MentionCandidate(person, new OtherUserAccess().canRead(person.userId(), table, id)));
+         result.add(new MentionCandidate(person, new CollaborationRecordAccessChecker().canRead(person.userId(), table, id)));
       }
       return (List.copyOf(result));
    }
@@ -244,7 +245,7 @@ public class CommentsService
    {
       if(body == null || body.isBlank() || body.length() > 20000)
       {
-         throw (new QException("Comment body must contain 1 to 20000 characters."));
+         throw (new QBadRequestException("Comment body must contain 1 to 20000 characters."));
       }
       Set<String> users = new LinkedHashSet<>();
       Matcher matcher = MENTION.matcher(body);
@@ -252,13 +253,13 @@ public class CommentsService
       {
          if(matcher.group(1).length() > 255)
          {
-            throw (new QException("Mention user ID is too long."));
+            throw (new QBadRequestException("Mention user ID is too long."));
          }
          users.add(matcher.group(1));
       }
       if(users.size() > 50)
       {
-         throw (new QException("A comment may mention at most 50 users."));
+         throw (new QBadRequestException("A comment may mention at most 50 users."));
       }
       return (users);
    }
@@ -279,7 +280,7 @@ public class CommentsService
          {
             continue;
          }
-         boolean visible = new OtherUserAccess().canRead(user, table, id).orElse(false);
+         boolean visible = new CollaborationRecordAccessChecker().canRead(user, table, id).orElse(false);
          QRecord mention = CollaborationRecords.insert(CollaborationTables.MENTION, reference(table, id).withValue("commentId", row.getValue("id"))
             .withValue("mentionedUserId", user).withValue("visible", visible));
          if(visible)
@@ -357,7 +358,7 @@ public class CommentsService
    }
 
    /*******************************************************************************
-    ** Shared feature permission stand-in.
+    ** Shared core record feature permission boundary.
     *******************************************************************************/
    private void requireCommentFeature(QRecord row) throws QException
    {
@@ -388,9 +389,9 @@ public class CommentsService
     *******************************************************************************/
    private void requireLimit(Integer limit) throws QException
    {
-      if(limit == null || limit < 1 || limit > 50)
+      if(limit == null || limit < 1 || limit > 100)
       {
-         throw (new QException("Limit must be between 1 and 50"));
+         throw (new QBadRequestException("Limit must be between 1 and 100"));
       }
    }
 

src/main/java/com/kingsrook/qbits/collaboration/favorites/FavoritesService.java

@@ -31,6 +31,7 @@ import java.util.Set;
 import com.kingsrook.qbits.collaboration.PersonalRecords;
 import com.kingsrook.qbits.collaboration.TargetResolver;
 import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
@@ -123,13 +124,13 @@ public final class FavoritesService
       Set<Integer> owned = new HashSet<>(rows.stream().map(row -> row.getValueInteger("id")).toList());
       if(ids == null || folders == null || new HashSet<>(ids).size() != ids.size() || !owned.containsAll(ids) || !owned.containsAll(folders.keySet()))
       {
-         throw (new QException("Invalid favorite ids"));
+         throw (new QBadRequestException("Invalid favorite ids"));
       }
       for(String folder : folders.values())
       {
          if(folder != null && folder.length() > 255)
          {
-            throw (new QException("Folder is too long"));
+            throw (new QBadRequestException("Folder is too long"));
          }
       }
       List<Integer> order = new ArrayList<>(ids);

src/main/java/com/kingsrook/qbits/collaboration/follow/FollowService.java

@@ -29,7 +29,7 @@ import com.kingsrook.qbits.collaboration.PersonalRecords;
 import com.kingsrook.qbits.collaboration.activity.ActivityWriter;
 import com.kingsrook.qbits.collaboration.model.CollaborationTables;
 import com.kingsrook.qbits.collaboration.people.PeopleService;
-import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qbits.collaboration.security.CollaborationRecordAccessChecker;
 import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
 import com.kingsrook.qqq.backend.core.context.QContext;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
@@ -107,7 +107,7 @@ public class FollowService
    {
       new PeopleService().touch();
       String id = canonicalId(table, recordId);
-      if(!userId.equals(PersonalRecords.currentUserId()) && !new OtherUserAccess().canRead(userId, table, id).orElse(false))
+      if(!userId.equals(PersonalRecords.currentUserId()) && !new CollaborationRecordAccessChecker().canRead(userId, table, id).orElse(false))
       {
          return;
       }

src/main/java/com/kingsrook/qbits/collaboration/model/CollaborationTables.java

@@ -58,7 +58,7 @@ import com.kingsrook.qqq.backend.core.model.metadata.tables.UniqueKey;
 
 
 /*******************************************************************************
- ** Visible Collaboration tables. Enum ids are phase-a stand-ins for the core
+ ** Visible Collaboration tables. Enum ids use the names of the core
  ** collaboration enums; replace them when those contracts are released.
  *******************************************************************************/
 public final class CollaborationTables
@@ -159,6 +159,9 @@ public final class CollaborationTables
          .withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.FIELD))
          .withSection(new QFieldSection("identity", new QIcon("badge"), Tier.T1, List.of("id", "scopeType", "scopeName", "feature")).withLabel("Identity"))
          .withSection(new QFieldSection("details", new QIcon("settings"), Tier.T2, List.of("enabled", "settings", "permissionMode")).withLabel("Details"));
+      settings.withCustomizer(TableCustomizers.POST_INSERT_RECORD, new QCodeReference(com.kingsrook.qbits.collaboration.FeatureSettingsCustomizer.class))
+         .withCustomizer(TableCustomizers.POST_UPDATE_RECORD, new QCodeReference(com.kingsrook.qbits.collaboration.FeatureSettingsCustomizer.class))
+         .withCustomizer(TableCustomizers.POST_DELETE_RECORD, new QCodeReference(com.kingsrook.qbits.collaboration.FeatureSettingsCustomizer.class));
       QTableMetaData people = base(config, USER, "People", "people")
          .withRecordLabelFormatAndFields("%s", "displayName")
          .withField(string("userId", "User ID", 255).withIsRequired(true))
@@ -189,6 +192,7 @@ public final class CollaborationTables
       for(QTableMetaData table : tables)
       {
          table.withSection(new QFieldSection("dates", new QIcon("calendar_today"), Tier.T3, List.of("createDate", "modifyDate")).withLabel("Dates"));
+         com.kingsrook.qbits.collaboration.CoreCollaboration.reference(table, config);
          QInstanceEnricher.setInferredFieldBackendNames(table);
       }
       return (tables);
@@ -401,6 +405,8 @@ public final class CollaborationTables
          .withSection(new QFieldSection("details", new QIcon("label"), Tier.T1,
             List.of("id", "name", "label", "color", "tableName", "approved", "description", "createdByUserId", "usageCount", "mergedIntoTagId")).withLabel("Details"));
       QTableMetaData links = referenced(config, RECORD_TAG, "Record Tags", "label")
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.NOT_PROTECTED)
+            .withCustomPermissionChecker(new QCodeReference(com.kingsrook.qbits.collaboration.security.CollaborationRowSecurity.class)))
          .withField(new QFieldMetaData("tagId", QFieldType.INTEGER).withIsRequired(true).withPossibleValueSourceName(TAG))
          .withField(string("createdByUserId", "Created By", 255).withIsRequired(true))
          .withUniqueKey(new UniqueKey("tableName", "recordId", "tagId"))

src/main/java/com/kingsrook/qbits/collaboration/mywork/MyWorkService.java

@@ -96,7 +96,7 @@ public class MyWorkService
    }
 
    /*******************************************************************************
-    ** Stable service contract for the subsequent UI API PR.
+    ** Stable service contract projected by the My work UI API.
     *******************************************************************************/
    public record Summary(Long openTaskCount, List<QRecord> tasks, Map<String, Long> assignedRecordsByTable, Long unreadMentionCount)
    {

src/main/java/com/kingsrook/qbits/collaboration/notify/Notifications.java

@@ -22,7 +22,7 @@
 package com.kingsrook.qbits.collaboration.notify;
 
 import com.kingsrook.qbits.collaboration.CollaborationRecords;
-import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qbits.collaboration.security.CollaborationRecordAccessChecker;
 import com.kingsrook.qqq.backend.core.actions.customizers.QCodeLoader;
 import com.kingsrook.qqq.backend.core.context.CapturedContext;
 import com.kingsrook.qqq.backend.core.context.QContext;
@@ -30,7 +30,7 @@ import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.utils.lambdas.UnsafeVoidVoidMethod;
 
 /*******************************************************************************
- ** Notification delivery uses RC.5 after-commit callbacks and fresh recipient access.
+ ** Notification delivery uses core after-commit callbacks and fresh recipient access.
  ** replace with a QAlerts.notify adapter when QRun-IO/qqq#1125 is released
  *******************************************************************************/
 public final class Notifications
@@ -97,10 +97,23 @@ public final class Notifications
     *******************************************************************************/
    private static void deliver(CollaborationNotification notification, UnsafeVoidVoidMethod<QException> receipt, boolean checkParent) throws QException
    {
-      if(!checkParent || new OtherUserAccess().canRead(notification.recipientUserId(), notification.sourceTableName(), notification.sourceRecordId()).orElse(false))
+      if(!checkParent || new CollaborationRecordAccessChecker().canRead(notification.recipientUserId(), notification.sourceTableName(), notification.sourceRecordId()).orElse(false))
       {
          CollaborationNotifier notifier = QCodeLoader.getAdHoc(CollaborationNotifier.class, CollaborationRecords.config().getNotifier());
          notifier.notify(notification);
+         if(!(notifier instanceof NoOpNotifier))
+         {
+            try
+            {
+               com.kingsrook.qqq.backend.core.realtime.RealtimeBus.get(QContext.getQInstance()).publish(
+                  new com.kingsrook.qqq.backend.core.realtime.RealtimeMessage().withChannel("user:" + notification.recipientUserId())
+                     .withEvent("notification.created").withData(java.util.Map.of("userId", notification.recipientUserId())));
+            }
+            catch(Exception e)
+            {
+               com.kingsrook.qqq.backend.core.logging.QLogger.getLogger(Notifications.class).warn("Could not publish notification hint", e);
+            }
+         }
          if(receipt != null && !(notifier instanceof NoOpNotifier))
          {
             receipt.run();

src/main/java/com/kingsrook/qbits/collaboration/people/PeopleService.java

@@ -30,6 +30,7 @@ import com.kingsrook.qbits.collaboration.CollaborationRecords;
 import com.kingsrook.qbits.collaboration.PersonalRecords;
 import com.kingsrook.qbits.collaboration.model.CollaborationTables;
 import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.CriteriaOption;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
@@ -112,9 +113,9 @@ public class PeopleService
    public List<PersonEntry> search(String q, Integer limit, Set<String> preferredUserIds) throws QException
    {
       PersonalRecords.currentUserId();
-      if(limit == null || limit < 1 || limit > 50)
+      if(limit == null || limit < 1 || limit > 100)
       {
-         throw (new QException("Limit must be between 1 and 50"));
+         throw (new QBadRequestException("Limit must be between 1 and 100"));
       }
       List<QRecord> rows = new ArrayList<>();
       if(!preferredUserIds.isEmpty())
@@ -159,4 +160,20 @@ public class PeopleService
       List<QRecord> rows = CollaborationRecords.query(CollaborationTables.USER, new QQueryFilter().withCriteria("userId", QCriteriaOperator.EQUALS, userId));
       return (rows.isEmpty() || rows.getFirst().getValueString("displayName") == null ? userId : rows.getFirst().getValueString("displayName"));
    }
+
+   /*******************************************************************************
+    ** Look up one active person with the same signed-in boundary as search.
+    *******************************************************************************/
+   public PersonEntry get(String userId) throws QException
+   {
+      touch();
+      List<QRecord> rows = CollaborationRecords.query(CollaborationTables.USER, new QQueryFilter()
+         .withCriteria("userId", QCriteriaOperator.EQUALS, userId).withCriteria("active", QCriteriaOperator.EQUALS, true).withLimit(1));
+      if(rows.isEmpty())
+      {
+         throw (new com.kingsrook.qqq.backend.core.exceptions.QNotFoundException("Not found"));
+      }
+      QRecord row = rows.getFirst();
+      return (new PersonEntry(row.getValueString("userId"), row.getValueString("displayName"), row.getValueString("email"), row.getValueInstant("lastSeenAt")));
+   }
 }

src/main/java/com/kingsrook/qbits/collaboration/security/CollaborationRecordAccessChecker.java

@@ -34,22 +34,31 @@ import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
 import com.kingsrook.qqq.backend.core.model.session.QSession;
 
 /*******************************************************************************
- ** Stand-in for core RecordAccessCheckerInterface. Unknown is never a grant.
+ ** Core other-user access checker. Unknown is never a grant.
  *******************************************************************************/
-public class OtherUserAccess
+public class CollaborationRecordAccessChecker implements com.kingsrook.qqq.backend.core.actions.collaboration.RecordAccessCheckerInterface
 {
+   /*******************************************************************************
+    ** Core reference-based access contract.
+    *******************************************************************************/
+   @Override
+   public Optional<Boolean> canRead(String userId, com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordReference ref) throws QException
+   {
+      return (canRead(userId, ref.tableName(), ref.primaryKey()));
+   }
+
    /*******************************************************************************
     ** The temporary context has no inherited permission bypass or caller transaction.
     *******************************************************************************/
    public Optional<Boolean> canRead(String userId, String table, Serializable recordId) throws QException
    {
       CollaborationQBitConfig config = CollaborationRecords.config();
-      if(config.getUserSessionSupplier() == null)
+      if(config.getUserSessionProvider() == null)
       {
          return (Optional.empty());
       }
-      UserSessionSupplier supplier = QCodeLoader.getAdHoc(UserSessionSupplier.class, config.getUserSessionSupplier());
-      Optional<QSession> session = supplier.sessionFor(userId);
+      com.kingsrook.qqq.backend.core.actions.collaboration.UserSessionProviderInterface supplier = QCodeLoader.getAdHoc(com.kingsrook.qqq.backend.core.actions.collaboration.UserSessionProviderInterface.class, config.getUserSessionProvider());
+      Optional<QSession> session = supplier.sessionForUser(userId);
       if(session.isEmpty())
       {
          return (Optional.empty());

src/main/java/com/kingsrook/qbits/collaboration/security/CollaborationRowSecurity.java

@@ -28,7 +28,6 @@ import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecke
 import com.kingsrook.qqq.backend.core.context.QContext;
 import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
 import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
-import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrCountInputInterface;
 import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
 import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
 import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
@@ -50,16 +49,21 @@ public class CollaborationRowSecurity implements CustomPermissionChecker
       {
          throw (new QPermissionDeniedException("Use the collaboration service actions."));
       }
-      new CollaborationPermissionChecker().checkPermissionsThrowing(input, metadata);
+      if(input instanceof com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput query && query.getFieldNamesToInclude() != null)
+      {
+         var fields = new java.util.HashSet<>(query.getFieldNamesToInclude());
+         fields.addAll(java.util.List.of("id", "tableName", "recordId", "parentDeleted"));
+         query.setFieldNamesToInclude(fields);
+      }
+      if(!(metadata instanceof QTableMetaData table && table.getName().equals(CollaborationTables.RECORD_TAG)))
+      {
+         new CollaborationPermissionChecker().checkPermissionsThrowing(input, metadata);
+      }
       if(metadata instanceof QTableMetaData table
          && (table.getName().equals(CollaborationTables.RECORD_ASSIGNMENT) || table.getName().equals(CollaborationTables.FOLLOW) || table.getName().equals(CollaborationTables.ACTIVITY) || table.getName().equals(CollaborationTables.FOLLOW_DIGEST))
          && !QContext.getQSession().hasPermission(CollaborationPermissions.ADMIN))
       {
          throw (new QPermissionDeniedException("This needs collaboration.admin."));
       }
-      if(input instanceof QueryOrCountInputInterface query)
-      {
-         ParentTableRestriction.restrict(query);
-      }
    }
 }

src/main/java/com/kingsrook/qbits/collaboration/security/ParentRecordAccess.java

@@ -23,23 +23,18 @@ package com.kingsrook.qbits.collaboration.security;
 
 import java.io.Serializable;
 import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
-import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
 import com.kingsrook.qqq.backend.core.actions.permissions.PermissionsHelper;
 import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
-import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
 import com.kingsrook.qqq.backend.core.context.QContext;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
 import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
-import com.kingsrook.qqq.backend.core.exceptions.QValueException;
 import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
-import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
 import com.kingsrook.qqq.backend.core.model.data.QRecord;
 import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
-import com.kingsrook.qqq.backend.core.utils.ValueUtils;
 
 /*******************************************************************************
- ** Stand-in for QQQ core RecordReferenceSecurityHelper (QRun-IO/qqq collaboration phase a); replace when released
+ ** Thin service boundary over core parent visibility and record capabilities.
  *******************************************************************************/
 public final class ParentRecordAccess
 {
@@ -69,32 +64,34 @@ public final class ParentRecordAccess
       {
          throw (new QNotFoundException("Not found"));
       }
-      QTableMetaData table = QContext.getQInstance().getTable(tableName);
       try
       {
-         Serializable key = ValueUtils.getValueAsFieldType(table.getField(table.getPrimaryKeyField()).getType(), recordId);
-         GetInput input = new GetInput(tableName).withPrimaryKey(key);
-         input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
-         QRecord parent = new GetAction().execute(input).getRecord();
+         var table = QContext.getQInstance().getTable(tableName);
+         Serializable key = com.kingsrook.qqq.backend.core.utils.ValueUtils.getValueAsFieldType(table.getField(table.getPrimaryKeyField()).getType(), recordId);
+         QRecord parent = com.kingsrook.qqq.backend.core.actions.collaboration.RecordReferenceSecurityHelper.visibleParent(tableName, key, QContext.getQBackendTransaction());
          if(parent == null)
          {
             throw (new QNotFoundException("Not found"));
          }
          return (parent);
       }
-      catch(QPermissionDeniedException | QValueException expected)
+      catch(com.kingsrook.qqq.backend.core.exceptions.QValueException e)
       {
          throw (new QNotFoundException("Not found"));
       }
    }
 
    /*******************************************************************************
-    ** Temporary approximation: EDIT plus a visible parent, not WRITE lock checks.
+    ** Core record capability checks include parent WRITE locks for implied grants.
     *******************************************************************************/
    public static void requireFeature(String tableName, Serializable recordId, String feature) throws QException
    {
-      requireVisibleParent(tableName, recordId);
-      requireTableFeature(tableName, feature);
+      QRecord parent = requireVisibleParent(tableName, recordId);
+      if(!com.kingsrook.qqq.backend.core.actions.collaboration.RecordFeaturePermissions.checkRecordCapability(
+         QContext.getQInstance().getTable(tableName), feature(feature), parent, QContext.getQBackendTransaction()))
+      {
+         throw (new QPermissionDeniedException("Permission denied for " + feature + "."));
+      }
    }
 
    /*******************************************************************************
@@ -106,13 +103,15 @@ public final class ParentRecordAccess
       {
          throw (new QNotFoundException("Not found"));
       }
-      QTableMetaData table = QContext.getQInstance().getTable(tableName);
-      String base = table.getPermissionRules() == null ? null : table.getPermissionRules().getPermissionBaseName();
-      base = base == null || base.isBlank() ? tableName : base;
-      if(!QContext.getQSession().hasPermission(tableName + "." + feature) && !QContext.getQSession().hasPermission(base + "." + feature)
-         && !PermissionsHelper.hasTablePermission(new AbstractActionInput(), tableName, TablePermissionSubType.EDIT))
-      {
-         throw (new QPermissionDeniedException("This needs the " + base + "." + feature + " permission or table EDIT."));
-      }
+      com.kingsrook.qqq.backend.core.actions.collaboration.RecordFeaturePermissions.requireTableCapability(QContext.getQInstance().getTable(tableName), feature(feature));
+   }
+
+   /*******************************************************************************
+    ** Map service operation suffixes to the core enum.
+    *******************************************************************************/
+   private static com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeature feature(String suffix)
+   {
+      return (java.util.Arrays.stream(com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeature.values())
+         .filter(value -> suffix.equals(value.getPermissionSuffix())).findFirst().orElseThrow());
    }
 }

src/main/java/com/kingsrook/qbits/collaboration/security/ParentTableRestriction.java

@@ -1,58 +0,0 @@
-/*
- * QQQ - Low-code Application Framework for Engineers.
- * Copyright (C) 2021-2025.  Kingsrook, LLC
- * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
- * contact@kingsrook.com
- * https://github.com/Kingsrook/
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-package com.kingsrook.qbits.collaboration.security;
-
-import java.util.List;
-import com.kingsrook.qqq.backend.core.context.QContext;
-import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrCountInputInterface;
-import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
-import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
-
-/*******************************************************************************
- ** Shared pre-query parent-table restriction. Record locks require post-filtering.
- *******************************************************************************/
-public final class ParentTableRestriction
-{
-   /*******************************************************************************
-    ** Static helper.
-    *******************************************************************************/
-   private ParentTableRestriction()
-   {
-   }
-
-   /*******************************************************************************
-    ** AND outside caller OR clauses while retaining paging and sort order.
-    *******************************************************************************/
-   public static void restrict(QueryOrCountInputInterface input)
-   {
-      List<String> readable = QContext.getQInstance().getTables().keySet().stream().filter(ParentRecordAccess::canReadTable).toList();
-      QQueryFilter original = input.getFilter();
-      QQueryFilter filter = new QQueryFilter().withCriteria("tableName", QCriteriaOperator.IN, readable)
-         .withCriteria("parentDeleted", QCriteriaOperator.EQUALS, false);
-      if(original != null)
-      {
-         filter.withSubFilter(original).withLimit(original.getLimit()).withSkip(original.getSkip());
-         filter.setOrderBys(original.getOrderBys());
-      }
-      input.setFilter(filter);
-   }
-}

src/main/java/com/kingsrook/qbits/collaboration/security/UserSessionSupplier.java

@@ -1,37 +0,0 @@
-/*
- * QQQ - Low-code Application Framework for Engineers.
- * Copyright (C) 2021-2025.  Kingsrook, LLC
- * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
- * contact@kingsrook.com
- * https://github.com/Kingsrook/
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-package com.kingsrook.qbits.collaboration.security;
-
-import java.util.Optional;
-import com.kingsrook.qqq.backend.core.exceptions.QException;
-import com.kingsrook.qqq.backend.core.model.session.QSession;
-
-/*******************************************************************************
- ** Stand-in for the unreleased core UserSessionProviderInterface.
- *******************************************************************************/
-public interface UserSessionSupplier
-{
-   /*******************************************************************************
-    ** Return a freshly authorized session, or unknown when identity is unavailable.
-    *******************************************************************************/
-   Optional<QSession> sessionFor(String userId) throws QException;
-}

src/main/java/com/kingsrook/qbits/collaboration/sharing/AccessRequestService.java

@@ -25,7 +25,6 @@ import java.io.Serializable;
 import java.time.Instant;
 import java.util.LinkedHashSet;
 import java.util.List;
-import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.atomic.AtomicBoolean;
 import com.kingsrook.qbits.collaboration.CollaborationRecords;
@@ -45,7 +44,6 @@ import com.kingsrook.qqq.backend.core.logging.QLogger;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
 import com.kingsrook.qqq.backend.core.model.data.QRecord;
-import com.kingsrook.qqq.backend.core.utils.JsonUtils;
 
 /*******************************************************************************
  ** Requests never inspect the parent. Their public result reveals no existence data.
@@ -108,25 +106,14 @@ public class AccessRequestService
     *******************************************************************************/
    public String approverPermission(String table) throws QException
    {
-      for(QRecord setting : CollaborationRecords.query(CollaborationTables.FEATURE_SETTING, new QQueryFilter()
-         .withCriteria("scopeType", QCriteriaOperator.EQUALS, "TABLE").withCriteria("scopeName", QCriteriaOperator.EQUALS, table)
-         .withCriteria("feature", QCriteriaOperator.EQUALS, "SHARING")))
+      var metadata = QContext.getQInstance().getTable(table);
+      if(metadata != null)
       {
-         String json = setting.getValueString("settings");
-         if(json != null && !json.isBlank())
+         Object permission = com.kingsrook.qqq.backend.core.actions.collaboration.RecordFeaturesResolver.resolve(QContext.getQInstance(), metadata)
+            .getFeatures().get(com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeature.SHARING).getSettings().get("accessApproverPermission");
+         if(permission != null && !permission.toString().isBlank())
          {
-            try
-            {
-               Object permission = JsonUtils.toObject(json, Map.class).get("accessApproverPermission");
-               if(permission != null && !permission.toString().isBlank())
-               {
-                  return (permission.toString());
-               }
-            }
-            catch(Exception e)
-            {
-               throw (new QException("Invalid SHARING settings JSON", e));
-            }
+            return (permission.toString());
          }
       }
       return (CollaborationPermissions.ADMIN);
@@ -234,4 +221,14 @@ public class AccessRequestService
       Notifications.sendAccessNotice(new CollaborationNotification(user, title, "Review the access request.",
          CollaborationNotification.Category.SHARE, null, null, "/app/collaboration_access_request/" + id));
    }
+
+   /*******************************************************************************
+    ** List only the current requester's submissions without inspecting parents.
+    *******************************************************************************/
+   public List<QRecord> mine() throws QException
+   {
+      return (CollaborationRecords.query(CollaborationTables.ACCESS_REQUEST, new QQueryFilter()
+         .withCriteria("requesterUserId", QCriteriaOperator.EQUALS, PersonalRecords.currentUserId())
+         .withOrderBy(new com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy("id", false))));
+   }
 }

src/main/java/com/kingsrook/qbits/collaboration/sharing/SharingService.java

@@ -36,7 +36,7 @@ import com.kingsrook.qbits.collaboration.model.CollaborationTables;
 import com.kingsrook.qbits.collaboration.notify.CollaborationNotification;
 import com.kingsrook.qbits.collaboration.notify.Notifications;
 import com.kingsrook.qbits.collaboration.people.PeopleService;
-import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qbits.collaboration.security.CollaborationRecordAccessChecker;
 import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
 import com.kingsrook.qqq.backend.core.context.QContext;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
@@ -72,7 +72,7 @@ public class SharingService
       List<Recipient> recipients = new ArrayList<>();
       for(String user : toUserIds.stream().distinct().toList())
       {
-         Optional<Boolean> access = user.equals(PersonalRecords.currentUserId()) ? Optional.of(true) : new OtherUserAccess().canRead(user, table, recordId);
+         Optional<Boolean> access = user.equals(PersonalRecords.currentUserId()) ? Optional.of(true) : new CollaborationRecordAccessChecker().canRead(user, table, recordId);
          recipients.add(new Recipient(user, new PeopleService().displayName(user), access.orElse(null)));
       }
       return (recipients);
@@ -127,7 +127,7 @@ public class SharingService
       }
       if(row.getValueInstant("openedAt") == null)
       {
-         CollaborationRecords.update(CollaborationTables.SHARE, new QRecord().withValue("id", shareId).withValue("openedAt", Instant.now()));
+         CollaborationRecords.acknowledgeShare(shareId, Instant.now());
       }
    }
 

src/main/java/com/kingsrook/qbits/collaboration/tags/TagCriteriaExpander.java

@@ -0,0 +1,125 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tags;
+
+import java.io.Serializable;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.actions.tables.query.CriteriaExpansionContext;
+import com.kingsrook.qqq.backend.core.actions.tables.query.SearchTermKind;
+import com.kingsrook.qqq.backend.core.actions.tables.query.VirtualFieldCriteriaExpanderInterface;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QUserFacingException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QSubQuery;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Tag membership uses core subqueries, preserving parent query security and paging.
+ *******************************************************************************/
+public class TagCriteriaExpander implements VirtualFieldCriteriaExpanderInterface
+{
+   /*******************************************************************************
+    ** Complements exclude records with any matching association.
+    *******************************************************************************/
+   @Override
+   public QQueryFilter expand(QTableMetaData table, QFilterCriteria criteria, CriteriaExpansionContext context) throws QException
+   {
+      var operator = criteria.getOperator();
+      if(operator == QCriteriaOperator.CONTAINS_ALL)
+      {
+         QQueryFilter all = new QQueryFilter();
+         for(Serializable value : criteria.getValues())
+         {
+            if(value == null)
+            {
+               throw (new QUserFacingException("Tags cannot contain null values"));
+            }
+            all.withSubFilter(membership(table, List.of(value), false, false));
+         }
+         return (all);
+      }
+      return (switch(operator)
+      {
+         case EQUALS, IN -> membership(table, criteria.getValues(), false, false);
+         case NOT_EQUALS, NOT_IN -> membership(table, criteria.getValues(), true, false);
+         case IS_BLANK -> membership(table, List.of(), true, true);
+         case IS_NOT_BLANK -> membership(table, List.of(), false, true);
+         default -> throw new QUserFacingException("Unsupported Tags operator: " + operator);
+      });
+   }
+
+   /*******************************************************************************
+    ** Numeric values are picker IDs; strings are exact normalized vocabulary names.
+    *******************************************************************************/
+   private QQueryFilter membership(QTableMetaData table, List<Serializable> values, boolean negate, boolean any) throws QException
+   {
+      QQueryFilter links = links(table);
+      if(!any)
+      {
+         QQueryFilter tags = TagsService.vocabularyFilter(table.getName()).withCriteria("approved", QCriteriaOperator.EQUALS, true);
+         QQueryFilter choices = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR);
+         if(values.isEmpty())
+         {
+            choices.withCriteria("id", QCriteriaOperator.IN, List.of());
+         }
+         for(Serializable value : values)
+         {
+            if(value == null)
+            {
+               throw (new QUserFacingException("Tags cannot contain null values"));
+            }
+            choices.withCriteria(value instanceof Number ? "id" : "name", QCriteriaOperator.EQUALS,
+               value instanceof Number ? value : TagsService.normalize(value.toString()));
+         }
+         tags.withSubFilter(choices);
+         links.withCriteria("tagId", QCriteriaOperator.IN, new QSubQuery(CollaborationTables.TAG, "id", tags));
+      }
+      return (new QQueryFilter().withCriteria(table.getPrimaryKeyField(), negate ? QCriteriaOperator.NOT_IN : QCriteriaOperator.IN,
+         new QSubQuery(CollaborationTables.RECORD_TAG, "recordId", links)));
+   }
+
+   /*******************************************************************************
+    ** Only live associations on this parent table participate.
+    *******************************************************************************/
+   private QQueryFilter links(QTableMetaData table)
+   {
+      return (new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table.getName())
+         .withCriteria("parentDeleted", QCriteriaOperator.EQUALS, false));
+   }
+
+   /*******************************************************************************
+    ** Ordinary search matches labels; hash search matches an exact normalized name.
+    *******************************************************************************/
+   @Override
+   public QQueryFilter expandSearchTerm(QTableMetaData table, String term, SearchTermKind kind, CriteriaExpansionContext context) throws QException
+   {
+      QQueryFilter tags = TagsService.vocabularyFilter(table.getName()).withCriteria("approved", QCriteriaOperator.EQUALS, true)
+         .withCriteria(kind == SearchTermKind.TAG ? "name" : "label", kind == SearchTermKind.TAG ? QCriteriaOperator.EQUALS : QCriteriaOperator.CONTAINS,
+            kind == SearchTermKind.TAG ? TagsService.normalize(term) : term);
+      return (new QQueryFilter().withCriteria(table.getPrimaryKeyField(), QCriteriaOperator.IN,
+         new QSubQuery(CollaborationTables.RECORD_TAG, "recordId", links(table)
+            .withCriteria("tagId", QCriteriaOperator.IN, new QSubQuery(CollaborationTables.TAG, "id", tags)))));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/tags/TagFilterTranslator.java

@@ -1,126 +0,0 @@
-/*
- * QQQ - Low-code Application Framework for Engineers.
- * Copyright (C) 2021-2025.  Kingsrook, LLC
- * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
- * contact@kingsrook.com
- * https://github.com/Kingsrook/
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-package com.kingsrook.qbits.collaboration.tags;
-
-import java.io.Serializable;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import com.kingsrook.qbits.collaboration.CollaborationRecords;
-import com.kingsrook.qbits.collaboration.model.CollaborationTables;
-import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
-import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
-import com.kingsrook.qqq.backend.core.context.QContext;
-import com.kingsrook.qqq.backend.core.exceptions.QException;
-import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
-import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
-import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
-import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
-import com.kingsrook.qqq.backend.core.model.data.QRecord;
-
-/*******************************************************************************
- ** Materialized tag filter logic independent of the unreleased core hooks in #1140.
- ** Every operator returns matching caller-visible parent ids, including complements.
- *******************************************************************************/
-public class TagFilterTranslator
-{
-   public static final int MAX_RECORD_IDS = 10000;
-
-   /*******************************************************************************
-    ** IN means any tag, CONTAINS_ALL means every requested tag, NOT_IN means none.
-    ** Empty IN matches none; empty CONTAINS_ALL and NOT_IN match all visible rows.
-    *******************************************************************************/
-   public List<String> recordIds(String table, String op, Collection<? extends Serializable> tags) throws QException
-   {
-      TagsService.requireTable(table);
-      if(!List.of("IN", "CONTAINS_ALL", "NOT_IN", "IS_BLANK", "IS_NOT_BLANK").contains(op))
-      {
-         throw (new QException("Unsupported tag operator: " + op));
-      }
-      Set<Integer> requested = new HashSet<>();
-      boolean missing = false;
-      if(!op.equals("IS_BLANK") && !op.equals("IS_NOT_BLANK"))
-      {
-         for(Serializable tag : tags == null ? List.<Serializable>of() : tags)
-         {
-            QQueryFilter filter = TagsService.vocabularyFilter(table).withCriteria("approved", QCriteriaOperator.EQUALS, true);
-            filter.withCriteria(tag instanceof Number ? "id" : "name", QCriteriaOperator.EQUALS,
-               tag instanceof Number ? tag : TagsService.normalize(tag == null ? null : tag.toString()));
-            List<QRecord> matches = CollaborationRecords.query(CollaborationTables.TAG, filter.withOrderBy(new QFilterOrderBy("id")));
-            if(matches.isEmpty())
-            {
-               missing = true;
-            }
-            else
-            {
-               QRecord match = matches.stream().filter(row -> row.getValue("tableName") == null).findFirst().orElse(matches.getFirst());
-               requested.add(match.getValueInteger("id"));
-            }
-         }
-      }
-      Map<String, Set<Integer>> assignments = new HashMap<>();
-      for(QRecord row : CollaborationRecords.query(CollaborationTables.RECORD_TAG, new QQueryFilter()
-         .withCriteria("tableName", QCriteriaOperator.EQUALS, table).withCriteria("parentDeleted", QCriteriaOperator.EQUALS, false)))
-      {
-         assignments.computeIfAbsent(row.getValueString("recordId"), ignored -> new HashSet<>()).add(row.getValueInteger("tagId"));
-      }
-      List<String> result = new ArrayList<>();
-      String key = QContext.getQInstance().getTable(table).getPrimaryKeyField();
-      for(int skip = 0; ; skip += 500)
-      {
-         QueryInput input = new QueryInput(table).withFilter(new QQueryFilter().withOrderBy(new QFilterOrderBy(key)).withSkip(skip).withLimit(500))
-            .withTransaction(QContext.getQBackendTransaction());
-         input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
-         List<QRecord> parents = new QueryAction().execute(input).getRecords();
-         for(QRecord parent : parents)
-         {
-            String id = parent.getValueString(key);
-            Set<Integer> applied = assignments.getOrDefault(id, Set.of());
-            boolean any = requested.stream().anyMatch(applied::contains);
-            boolean match = switch(op)
-            {
-               case "IN" -> any;
-               case "NOT_IN" -> !any;
-               case "CONTAINS_ALL" -> !missing && applied.containsAll(requested);
-               case "IS_BLANK" -> applied.isEmpty();
-               default -> !applied.isEmpty();
-            };
-            if(match)
-            {
-               result.add(id);
-               if(result.size() > MAX_RECORD_IDS)
-               {
-                  throw (new QException("Tag filter exceeds 10,000 matching record ids."));
-               }
-            }
-         }
-         if(parents.size() < 500)
-         {
-            return (result);
-         }
-      }
-   }
-}

src/main/java/com/kingsrook/qbits/collaboration/tags/TagsMetaDataProvider.java

@@ -0,0 +1,121 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tags;
+
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.FeatureSettingsProvider;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.actions.collaboration.RuntimeMetaDataProviderInterface;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeature;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeatureOverride;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeaturesMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RuntimeMetaDataContribution;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RuntimeTableMetaDataContribution;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QVirtualFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.Capability;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Contribute the Tags filter and quick-search field without changing host hooks.
+ *******************************************************************************/
+public class TagsMetaDataProvider implements RuntimeMetaDataProviderInterface
+{
+   /*******************************************************************************
+    ** Overlay providers run before the new feature snapshot is published.
+    *******************************************************************************/
+   @Override
+   public RuntimeMetaDataContribution getContribution(QInstance instance) throws QException
+   {
+      var contribution = new RuntimeMetaDataContribution();
+      var overrides = new FeatureSettingsProvider().getOverrides(instance);
+      for(var table : instance.getTables().values())
+      {
+         if(!table.getName().startsWith("collaboration_") && table.getPrimaryKeyField() != null
+            && (table.isCapabilityEnabled(instance.getBackend(table.getBackendName()), Capability.TABLE_GET) || table.isCapabilityEnabled(instance.getBackend(table.getBackendName()), Capability.TABLE_QUERY))
+            && enabled(instance, table, overrides))
+         {
+            contribution.getTables().put(table.getName(), new RuntimeTableMetaDataContribution()
+               .withVirtualFields(List.of(new QVirtualFieldMetaData("collaborationTags", QFieldType.STRING).withLabel("Tags")
+                  .withPossibleValueSourceName(CollaborationTables.TAG).withIsQueryCriteria(true).withIsQuerySelectable(false)
+                  .withCriteriaExpander(new QCodeReference(TagCriteriaExpander.class))))
+               .withSearchFields(List.of("collaborationTags")));
+         }
+      }
+      return (contribution);
+   }
+
+   /*******************************************************************************
+    ** Resolve TAGS against the incoming policy in core's instance/app/table order.
+    *******************************************************************************/
+   private boolean enabled(QInstance instance, QTableMetaData table, List<RecordFeatureOverride> overrides)
+   {
+      List<RecordFeaturesMetaData> levels = new ArrayList<>();
+      List<String> apps = new ArrayList<>();
+      levels.add(RecordFeaturesMetaData.of(instance));
+      if(instance.getApps() != null)
+      {
+         for(var app : instance.getApps().values())
+         {
+            if(app.getSections() != null && app.getSections().stream().anyMatch(section -> section.getTables() != null && section.getTables().contains(table.getName())))
+            {
+               levels.add(RecordFeaturesMetaData.of(app));
+               apps.add(app.getName());
+            }
+         }
+      }
+      levels.add(RecordFeaturesMetaData.of(table));
+      boolean enabled = false;
+      for(var level : levels)
+      {
+         if(level != null)
+         {
+            if(Boolean.FALSE.equals(level.getFeatureLocks().get(RecordFeature.TAGS)))
+            {
+               return (false);
+            }
+            enabled = level.getEnabled().getOrDefault(RecordFeature.TAGS, enabled);
+         }
+      }
+      for(var scope : RecordFeatureOverride.ScopeType.values())
+      {
+         List<String> scopes = scope == RecordFeatureOverride.ScopeType.APP ? apps : java.util.Collections.singletonList(scope == RecordFeatureOverride.ScopeType.TABLE ? table.getName() : null);
+         for(String scopeName : scopes)
+         {
+            for(var override : overrides)
+            {
+               if(override.getFeature() == RecordFeature.TAGS && override.getScopeType() == scope && override.getEnabled() != null
+                  && (scope == RecordFeatureOverride.ScopeType.INSTANCE || (scope == RecordFeatureOverride.ScopeType.APP && scopeName.equals(override.getScopeName()))
+                  || (scope == RecordFeatureOverride.ScopeType.TABLE && table.getName().equals(override.getScopeName()))))
+               {
+                  enabled = override.getEnabled();
+               }
+            }
+         }
+      }
+      return (enabled);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/tags/TagsService.java

@@ -34,8 +34,8 @@ import com.kingsrook.qbits.collaboration.PersonalRecords;
 import com.kingsrook.qbits.collaboration.activity.ActivityWriter;
 import com.kingsrook.qbits.collaboration.model.CollaborationTables;
 import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
-import com.kingsrook.qqq.backend.core.context.CapturedContext;
 import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
 import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
@@ -43,8 +43,6 @@ import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperat
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
 import com.kingsrook.qqq.backend.core.model.data.QRecord;
-import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
-import com.kingsrook.qqq.backend.core.utils.JsonUtils;
 
 /*******************************************************************************
  ** Tag vocabulary and assignments. Parent authorization precedes trusted storage.
@@ -63,7 +61,7 @@ public class TagsService
       String name = label == null ? "" : label.strip().toLowerCase(Locale.ROOT).replaceAll("(?U)\\s+", " ").strip();
       if(name.isEmpty() || name.length() > 60)
       {
-         throw (new QException("Tag names must contain 1 to 60 characters."));
+         throw (new QBadRequestException("Tag names must contain 1 to 60 characters."));
       }
       return (name);
    }
@@ -99,65 +97,18 @@ public class TagsService
    }
 
    /*******************************************************************************
-    ** Resolve persisted policy as system, preserving the caller and transaction.
-    ** The preferred app path supplies the APP scope when a table has several apps.
+    ** Read core's committed policy with instance/app/table resolution and hard limits.
     *******************************************************************************/
    public String mode(String table) throws QException
    {
-      List<String> resolved = new ArrayList<>();
-      QContext.withTemporaryContext(new CapturedContext(QContext.getQInstance(), new QSystemUserSession(), QContext.getQBackendTransaction(), null), () ->
+      Object setting = com.kingsrook.qqq.backend.core.actions.collaboration.RecordFeaturesResolver.resolve(QContext.getQInstance(), QContext.getQInstance().getTable(table))
+         .getFeatures().get(com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeature.TAGS).getSettings().get("mode");
+      String mode = setting == null ? CollaborationRecords.config().getDefaultTagMode() : setting.toString();
+      if(!List.of("FREE", "APPROVED_ONLY").contains(mode))
       {
-         String path = QContext.getQInstance().getTablePath(table);
-         String[] parts = path == null ? new String[0] : path.split("/");
-         String app = parts.length > 2 ? parts[parts.length - 2] : null;
-         for(String scope : List.of("TABLE", "APP", "INSTANCE"))
-         {
-            if(scope.equals("APP") && app == null)
-            {
-               continue;
-            }
-            QQueryFilter filter = new QQueryFilter().withCriteria("feature", QCriteriaOperator.EQUALS, "TAGS")
-               .withCriteria("scopeType", QCriteriaOperator.EQUALS, scope);
-            if(!scope.equals("INSTANCE"))
-            {
-               filter.withCriteria("scopeName", QCriteriaOperator.EQUALS, scope.equals("TABLE") ? table : app);
-            }
-            for(QRecord row : CollaborationRecords.query(CollaborationTables.FEATURE_SETTING, filter))
-            {
-               String json = row.getValueString("settings");
-               if(json != null && !json.isBlank())
-               {
-                  Object value = settingMode(json);
-                  if(value != null)
-                  {
-                     String mode = value.toString();
-                     if(!List.of("FREE", "APPROVED_ONLY").contains(mode))
-                     {
-                        throw (new QException("Invalid TAGS mode: " + mode));
-                     }
-                     resolved.add(mode);
-                     return;
-                  }
-               }
-            }
-         }
-      });
-      return (resolved.isEmpty() ? CollaborationRecords.config().getDefaultTagMode() : resolved.getFirst());
-   }
-
-   /*******************************************************************************
-    ** Invalid JSON fails closed instead of silently relaxing an approval policy.
-    *******************************************************************************/
-   private Object settingMode(String json) throws QException
-   {
-      try
-      {
-         return (JsonUtils.toObject(json, Map.class).get("mode"));
-      }
-      catch(Exception e)
-      {
-         throw (new QException("Invalid TAGS settings JSON", e));
+         throw (new QException("Invalid TAGS mode: " + mode));
       }
+      return (mode);
    }
 
    /*******************************************************************************
@@ -185,7 +136,7 @@ public class TagsService
             if(row.getValue("mergedIntoTagId") != null || (!Boolean.TRUE.equals(row.getValueBoolean("approved"))
                && !PersonalRecords.currentUserId().equals(row.getValueString("createdByUserId")) && !canManage()))
             {
-               throw (new QException("Tag name is already reserved."));
+               throw (new QBadRequestException("Tag name is already reserved."));
             }
             return (entry(row));
          }
@@ -235,7 +186,7 @@ public class TagsService
          {
             if(!createMissing || value instanceof Number || !mode(table).equals("FREE"))
             {
-               throw (new QException("Pick an approved tag (or suggest one)"));
+               throw (new QBadRequestException("Pick an approved tag (or suggest one)"));
             }
             row = requireTag(create(table, value.toString(), null).id());
          }
@@ -245,7 +196,7 @@ public class TagsService
          }
          if(!Boolean.TRUE.equals(row.getValueBoolean("approved")))
          {
-            throw (new QException("Pick an approved tag (or suggest one)"));
+            throw (new QBadRequestException("Pick an approved tag (or suggest one)"));
          }
          result.put(row.getValueInteger("id"), row);
       }
@@ -367,10 +318,10 @@ public class TagsService
    {
       synchronized(CollaborationRecords.config())
       {
-         for(QRecord link : CollaborationRecords.query(CollaborationTables.RECORD_TAG, new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table)
+         for(QRecord link : CollaborationRecords.cleanupQuery(CollaborationTables.RECORD_TAG, new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table)
             .withCriteria("recordId", QCriteriaOperator.IN, ids.stream().map(Object::toString).toList())))
          {
-            CollaborationRecords.delete(CollaborationTables.RECORD_TAG, link.getValue("id"));
+            CollaborationRecords.cleanupDelete(CollaborationTables.RECORD_TAG, link.getValue("id"));
             recompute(link.getValue("tagId"));
          }
       }

src/main/java/com/kingsrook/qbits/collaboration/tasks/TasksService.java

@@ -204,7 +204,7 @@ public class TasksService
       int size = limit == null ? 20 : limit;
       if(size < 1 || size > 100)
       {
-         throw (new QException("Limit must be between 1 and 100."));
+         throw (new com.kingsrook.qqq.backend.core.exceptions.QBadRequestException("Limit must be between 1 and 100."));
       }
       List<QRecord> rows = mineRows(status);
       if(cursor != null)
@@ -224,7 +224,7 @@ public class TasksService
       String selected = status == null ? "OPEN" : status;
       if(!List.of("OPEN", "DONE", "CANCELLED").contains(selected))
       {
-         throw (new QException("Unknown task status."));
+         throw (new com.kingsrook.qqq.backend.core.exceptions.QBadRequestException("Unknown task status."));
       }
       List<QRecord> visible = new ArrayList<>();
       for(QRecord row : CollaborationRecords.query(CollaborationTables.TASK, new QQueryFilter()
@@ -306,7 +306,7 @@ public class TasksService
       }
       catch(RuntimeException e)
       {
-         throw (new QException("Invalid cursor", e));
+         throw (new com.kingsrook.qqq.backend.core.exceptions.QBadRequestException("Invalid cursor", e));
       }
    }
 

src/main/java/com/kingsrook/qbits/collaboration/timeline/TimelineService.java

@@ -37,6 +37,7 @@ import com.kingsrook.qqq.backend.core.actions.metadata.personalization.TableMeta
 import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
 import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
 import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
 import com.kingsrook.qqq.backend.core.model.actions.metadata.personalization.TableMetaDataPersonalizerInput;
@@ -61,14 +62,14 @@ public class TimelineService
    public TimelinePage timeline(String table, Serializable recordId, String beforeCursor, Integer limit, Set<String> types) throws QException
    {
       String id = FollowService.canonicalId(table, recordId);
-      if(limit == null || limit < 1 || limit > 50)
+      if(limit == null || limit < 1 || limit > 100)
       {
-         throw (new QException("Limit must be between 1 and 50"));
+         throw (new QBadRequestException("Limit must be between 1 and 100"));
       }
       RecordCursor before = beforeCursor == null ? null : RecordCursor.decode(beforeCursor);
       if(before != null && before.kind().equals("COMMENT"))
       {
-         throw (new QException("Invalid timeline cursor"));
+         throw (new QBadRequestException("Invalid timeline cursor"));
       }
       List<TimelineItem> items = new ArrayList<>();
       boolean all = types == null || types.isEmpty();

src/test/java/com/kingsrook/qbits/collaboration/CollaborationApiContractTest.java

@@ -0,0 +1,81 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import com.kingsrook.qbits.collaboration.api.CollaborationApi;
+import com.kingsrook.qqq.backend.core.model.metadata.QBackendMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryBackendModule;
+import com.kingsrook.qqq.middleware.javalin.specs.extensions.MiddlewareSpecExtensionsMetaData;
+import com.kingsrook.qqq.middleware.javalin.specs.v1.MiddlewareVersionV1;
+import com.kingsrook.qqq.middleware.javalin.tools.UiApiContract;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+/*******************************************************************************
+ ** The committed extension fragment must describe exactly the shipped specs.
+ *******************************************************************************/
+class CollaborationApiContractTest
+{
+   /*******************************************************************************
+    ** Opt-in regeneration uses the same deterministic generator as QQQ core.
+    *******************************************************************************/
+   @Test
+   void contract() throws Exception
+   {
+      var extension = CollaborationApi.extension();
+      var version = new MiddlewareVersionV1();
+      String generated = UiApiContract.generateExtensionYaml(version, extension);
+      Path path = Path.of("src/main/resources/openapi/qqq-v1/collaboration.yaml");
+      if(Boolean.getBoolean("collaboration.openapi.update"))
+      {
+         Files.createDirectories(path.getParent());
+         Files.writeString(path, generated);
+      }
+      assertThat(UiApiContract.check(generated, Files.readString(path), null, 1,
+         "mvnw.cmd -o -q -Dtest=CollaborationApiContractTest -Dcollaboration.openapi.update=true test")).isEmpty();
+      var model = version.generateExtensionOpenAPIModel("qqq", extension);
+      assertThat(model.getComponents().getSchemas().keySet()).allMatch(name -> name.startsWith("Collaboration"));
+      assertThat(model.getPaths().keySet()).allMatch(pathName -> pathName.startsWith("/qqq/v1/qbit/collaboration/"));
+      assertThat(generated).contains("multipart/form-data", "format: \"binary\"", "clients follow url", "nextCursor");
+      assertThat(extension.getSpecs()).hasSize(42);
+   }
+
+   /*******************************************************************************
+    ** Hosts may opt out; default registration uses the default namespace.
+    *******************************************************************************/
+   @Test
+   void registrationCanBeDisabled() throws Exception
+   {
+      QInstance disabled = new QInstance();
+      disabled.addBackend(new QBackendMetaData().withName("memory").withBackendType(MemoryBackendModule.class));
+      new CollaborationQBitProducer().withQBitConfig(new CollaborationQBitConfig().withBackendName("memory").withUiApi(false)).produce(disabled);
+      assertThat(MiddlewareSpecExtensionsMetaData.ofOrWithNew(disabled).getExtensions()).isEmpty();
+      QInstance enabled = new QInstance();
+      enabled.addBackend(new QBackendMetaData().withName("memory").withBackendType(MemoryBackendModule.class));
+      new CollaborationQBitProducer().withQBitConfig(new CollaborationQBitConfig().withBackendName("memory")).produce(enabled);
+      assertThat(MiddlewareSpecExtensionsMetaData.ofOrWithNew(enabled).getExtensions()).hasSize(1);
+      assertThat(CollaborationApi.extension().getEffectivePathPrefix()).isEqualTo("/qbit/collaboration");
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/CollaborationApiHttpTest.java

@@ -0,0 +1,485 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.io.IOException;
+import java.net.ServerSocket;
+import java.net.URI;
+import java.net.URL;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.charset.StandardCharsets;
+import java.time.Duration;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentStorage;
+import com.kingsrook.qbits.objectstorage.api.PresignGet;
+import com.kingsrook.qbits.objectstorage.api.PutRequest;
+import com.kingsrook.qqq.backend.core.instances.AbstractQQQApplication;
+import com.kingsrook.qqq.backend.core.model.metadata.QAuthenticationType;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.authentication.QAuthenticationMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QUser;
+import com.kingsrook.qqq.backend.core.modules.authentication.QAuthenticationModuleCustomizerInterface;
+import com.kingsrook.qqq.middleware.javalin.QApplicationJavalinServer;
+import com.kingsrook.qqq.middleware.javalin.QJavalinImplementation;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+/*******************************************************************************
+ ** Real HTTP, real memory actions, and real parent locks; only file storage is fake.
+ *******************************************************************************/
+class CollaborationApiHttpTest extends PersonalServiceFixture
+{
+   private static final ObjectMapper JSON = new ObjectMapper();
+   private final HttpClient client = HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NEVER).build();
+   private QApplicationJavalinServer server;
+   private String baseUrl;
+   private String sessionSuffix;
+
+   /*******************************************************************************
+    ** Select a free loopback port and use the same mock-auth customization as hosts.
+    *******************************************************************************/
+   @BeforeEach
+   void start() throws Exception
+   {
+      MemoryStorage.objects.clear();
+      MemoryStorage.lastGet = null;
+      MemoryStorage.fail = false;
+      config.withAttachmentStorage(new QCodeReference(MemoryStorage.class));
+      instance.withInstanceDefaultAuthentication(new QAuthenticationMetaData().withName("mock").withType(QAuthenticationType.MOCK)
+         .withCustomizer(new QCodeReference(TestSessions.class)));
+      int port;
+      try(ServerSocket socket = new ServerSocket(0))
+      {
+         port = socket.getLocalPort();
+      }
+      sessionSuffix = "-" + UUID.randomUUID();
+      baseUrl = "http://127.0.0.1:" + port + "/qqq/v1/qbit/collaboration";
+      server = new QApplicationJavalinServer(new AbstractQQQApplication()
+      {
+         @Override
+         public QInstance defineQInstance()
+         {
+            return (instance);
+         }
+      }).withPort(port).withServeFrontendNext(false).withServeFrontendMaterialDashboard(false)
+         .withServeLegacyUnversionedMiddlewareAPI(false).withStrictUiApiRoutes(true);
+      server.start();
+   }
+
+   /*******************************************************************************
+    ** Release HTTP and global server resources between tests.
+    *******************************************************************************/
+   @AfterEach
+   void stop()
+   {
+      if(server != null)
+      {
+         server.stop();
+      }
+      client.close();
+      QJavalinImplementation.setSessionCookieHttpOnly(false);
+      MemoryStorage.objects.clear();
+   }
+
+   /*******************************************************************************
+    ** Sharing validates recipients and access requests never reveal parent existence.
+    *******************************************************************************/
+   @Test
+   void sharingAndAccessRequests() throws Exception
+   {
+      assertThat(ok("GET", "/records/document/001/link", null).get("label").asText()).isEqualTo("First document");
+      var preview = ok("POST", "/records/document/1/shares/preview", "{\"toUserIds\":[\"alice\",\"unknown\"]}");
+      assertThat(preview.at("/recipients/0/canRead").asBoolean()).isTrue();
+      assertThat(preview.at("/recipients/1/canRead").isNull()).isTrue();
+      assertThat(ok("POST", "/records/document/1/shares", "{\"toUserIds\":[\"alice\"],\"message\":\"Review\"}").get("items")).hasSize(1);
+      assertError(400, "POST", "/records/document/1/shares", "{\"toUserIds\":[]}", "alice");
+      assertError(403, "POST", "/records/document/1/shares/preview", "{\"toUserIds\":[\"alice\"]}", "reader");
+      assertError(404, "GET", "/records/document/3/link", null, "alice");
+      var request = ok("POST", "/access-requests", "{\"tableName\":\"document\",\"recordId\":\"999\",\"message\":\"Please\"}");
+      assertThat(request.get("status").asText()).isEqualTo("OPEN");
+      assertThat(ok("GET", "/access-requests/mine", null).get("items")).hasSize(1);
+      assertThat(json(request("GET", "/access-requests/mine", null, "reader"), 200).get("items")).isEmpty();
+      assertError(400, "POST", "/access-requests", "{\"tableName\":\"document\"}", "alice");
+   }
+
+   /*******************************************************************************
+    ** Tasks support partial edits, status transitions, caller lists and assignment.
+    *******************************************************************************/
+   @Test
+   void tasksAssignmentsAndMyWork() throws Exception
+   {
+      var task = ok("POST", "/records/document/1/tasks", "{\"title\":\"Review\",\"dueAt\":\"2026-12-01T00:00:00Z\"}");
+      String path = "/tasks/" + task.get("id").asInt();
+      assertThat(ok("GET", "/records/document/1/tasks", null).get("items")).hasSize(1);
+      assertThat(ok("GET", "/tasks/mine", null).get("items")).hasSize(1);
+      assertThat(ok("PATCH", path, "{\"notes\":\"Keep title\"}").get("title").asText()).isEqualTo("Review");
+      assertThat(ok("PATCH", path, "{\"status\":\"DONE\"}").get("status").asText()).isEqualTo("DONE");
+      assertThat(ok("GET", "/tasks/mine?status=DONE", null).get("items")).hasSize(1);
+      assertThat(ok("GET", "/records/document/1/tasks", null).get("items")).isEmpty();
+      assertThat(ok("GET", "/records/document/1/tasks?includeDone=true", null).get("items")).hasSize(1);
+      ok("PATCH", path, "{\"status\":\"OPEN\"}");
+      ok("PATCH", path, "{\"status\":\"CANCELLED\"}");
+      ok("PATCH", path, "{\"status\":\"OPEN\",\"dueAt\":null}");
+      assertThat(ok("PUT", "/records/document/1/assignment", "{\"ownerUserId\":\"alice\",\"assigneeUserId\":\"alice\"}").get("ownerUserId").asText()).isEqualTo("alice");
+      var work = ok("GET", "/my-work", null);
+      assertThat(work.get("openTaskCount").asInt()).isEqualTo(1);
+      assertThat(work.at("/assignedRecordsByTable/document").asInt()).isEqualTo(1);
+      assertThat(work.get("tasks")).hasSize(1);
+      assertError(400, "PATCH", path, "{\"status\":\"INVALID\",\"title\":\"Not saved\"}", "alice");
+      assertError(400, "PATCH", path, "{\"dueAt\":\"invalid\"}", "alice");
+      assertError(403, "PATCH", path, "{\"title\":\"Denied\"}", "reader");
+      assertError(404, "PATCH", path, "{}", "outsider");
+      assertError(404, "POST", "/records/document/3/tasks", "{}", "alice");
+      assertError(403, "PUT", "/records/document/1/assignment", "{}", "reader");
+      assertError(400, "GET", "/tasks/mine?status=UNKNOWN", null, "alice");
+      assertError(400, "GET", "/records/document/1/tasks?includeDone=wrong", null, "alice");
+      assertError(400, "POST", "/records/document/1/tasks", "{\"title\":5}", "alice");
+   }
+
+   /*******************************************************************************
+    ** Every personal operation and offset cursor runs through the HTTP boundary.
+    *******************************************************************************/
+   @Test
+   void favoritesAndRecents() throws Exception
+   {
+      String first = "{\"targetType\":\"RECORD\",\"targetName\":\"document\",\"recordId\":\"1\"}";
+      String second = first.replace("\"1\"", "\"2\"");
+      assertThat(ok("PUT", "/favorites", first).get("success").asBoolean()).isTrue();
+      ok("PUT", "/favorites", second);
+      JsonNode page = ok("GET", "/favorites?limit=1", null);
+      assertThat(page.get("items")).hasSize(1);
+      assertThat(page.at("/items/0/label").asText()).isEqualTo("First document");
+      assertThat(page.at("/items/0/available").asBoolean()).isTrue();
+      JsonNode next = ok("GET", "/favorites?limit=1&cursor=" + page.get("nextCursor").asText(), null);
+      int secondId = next.at("/items/0/id").asInt();
+      assertThat(next.at("/items/0/recordId").asText()).isEqualTo("2");
+      assertThat(next.get("nextCursor").isNull()).isTrue();
+      ok("PATCH", "/favorites/order", "{\"ids\":[" + secondId + "],\"folders\":{\"" + secondId + "\":\"Work\"}}");
+      assertThat(ok("GET", "/favorites", null).at("/items/0/folder").asText()).isEqualTo("Work");
+      ok("DELETE", "/favorites", first);
+      assertThat(ok("GET", "/favorites", null).get("items")).hasSize(1);
+      ok("POST", "/recents", first);
+      assertThat(ok("GET", "/recents", null).at("/items/0/recordId").asText()).isEqualTo("1");
+      assertThat(request("GET", "/favorites", null, "reader").body()).contains("\"items\":[]");
+      assertError(400, "GET", "/favorites?cursor=broken", null, "alice");
+      assertError(400, "PATCH", "/favorites/order", "{\"ids\":[99999]}", "alice");
+      assertError(400, "PUT", "/favorites", "{\"targetType\":\"WRONG\",\"targetName\":\"document\"}", "alice");
+      assertError(404, "PUT", "/favorites", first.replace("\"1\"", "\"3\""), "alice");
+   }
+
+   /*******************************************************************************
+    ** Multipart bytes, metadata, temporary URLs, rename, deletion and failure safety.
+    *******************************************************************************/
+   @Test
+   void attachments() throws Exception
+   {
+      JsonNode uploaded = json(upload("alice", "report.txt", "hello", "/records/document/1/attachments"), 200);
+      int id = uploaded.get("id").asInt();
+      assertThat(uploaded.get("fileName").asText()).isEqualTo("report.txt");
+      assertThat(uploaded.get("sizeBytes").asLong()).isEqualTo(5);
+      assertThat(uploaded.get("description").asText()).isEqualTo("A report");
+      assertThat(uploaded.get("createdByUserId").asText()).isEqualTo("alice");
+      assertThat(uploaded.has("storageKey")).isFalse();
+      assertThat(MemoryStorage.objects.values()).singleElement().satisfies(bytes -> assertThat(new String(bytes, StandardCharsets.UTF_8)).isEqualTo("hello"));
+      assertThat(ok("GET", "/records/document/1/attachments", null).get("items")).hasSize(1);
+      assertThat(ok("GET", "/attachments/" + id + "/download", null).get("url").asText()).startsWith("https://files.example.invalid/");
+      assertThat(MemoryStorage.lastGet.getDownloadAs()).isEqualTo("report.txt");
+      assertThat(MemoryStorage.lastGet.getTtl()).isEqualTo(Duration.ofMinutes(5));
+      ok("GET", "/attachments/" + id + "/preview", null);
+      assertThat(MemoryStorage.lastGet.getDownloadAs()).isNull();
+      assertThat(ok("PATCH", "/attachments/" + id, "{\"fileName\":\"renamed.txt\",\"description\":\"\"}").get("fileName").asText()).isEqualTo("renamed.txt");
+      assertError(403, "PATCH", "/attachments/" + id, "{\"description\":\"no\"}", "reader");
+      assertError(404, "GET", "/attachments/" + id + "/download", null, "outsider");
+      assertError(400, "POST", "/records/document/1/attachments", "{}", "alice");
+      assertThat(upload("reader", "x.txt", "x", "/records/document/1/attachments").statusCode()).isEqualTo(403);
+      assertThat(upload("alice", "x.txt", "x", "/records/document/3/attachments").statusCode()).isEqualTo(404);
+      config.withDefaultMaxBytes(2L);
+      assertThat(upload("alice", "x.txt", "toolarge", "/records/document/1/attachments").statusCode()).isEqualTo(400);
+      assertThat(MemoryStorage.objects).hasSize(1);
+      config.withDefaultMaxBytes(1000L).withBlockedExtensions(List.of("exe"));
+      assertThat(upload("alice", "x.exe", "x", "/records/document/1/attachments").statusCode()).isEqualTo(400);
+      MemoryStorage.fail = true;
+      assertThat(request("GET", "/attachments/" + id + "/download", null, "alice").statusCode()).isEqualTo(500);
+      MemoryStorage.fail = false;
+      ok("DELETE", "/attachments/" + id, null);
+      assertThat(MemoryStorage.objects).isEmpty();
+      assertError(404, "GET", "/attachments/" + id + "/preview", null, "alice");
+   }
+
+   /*******************************************************************************
+    ** Vocabulary creation and record associations preserve caller permissions.
+    *******************************************************************************/
+   @Test
+   void tags() throws Exception
+   {
+      JsonNode tag = ok("POST", "/tags", "{\"table\":\"document\",\"label\":\"Urgent\",\"color\":\"red\"}");
+      assertThat(tag.get("approved").asBoolean()).isTrue();
+      assertThat(ok("GET", "/tags?table=document&q=urg", null).at("/items/0/name").asText()).isEqualTo("urgent");
+      int id = tag.get("id").asInt();
+      assertThat(ok("PUT", "/records/document/1/tags", "{\"add\":[" + id + "]}").get("items")).hasSize(1);
+      assertThat(ok("GET", "/records/document/1/tags", null).at("/items/0/id").asInt()).isEqualTo(id);
+      ok("PUT", "/records/document/1/tags", "{\"remove\":[" + id + "]}");
+      assertThat(ok("GET", "/records/document/1/tags", null).get("items")).isEmpty();
+      assertError(403, "POST", "/tags", "{\"table\":\"document\",\"label\":\"Denied\"}", "reader");
+      assertError(400, "POST", "/tags", "{\"table\":\"document\",\"label\":\"\"}", "alice");
+      assertError(400, "PUT", "/records/document/1/tags", "{\"add\":[null]}", "alice");
+      assertError(400, "PUT", "/records/document/1/tags", "{\"add\":[1.5]}", "alice");
+   }
+
+   /*******************************************************************************
+    ** Comments, revisions, mentions, follow settings and the merged timeline.
+    *******************************************************************************/
+   @Test
+   void conversationsAndTimeline() throws Exception
+   {
+      ok("DELETE", "/records/document/1/follow", null);
+      assertThat(ok("GET", "/records/document/1/follow", null).get("following").asBoolean()).isFalse();
+      JsonNode root = ok("POST", "/records/document/1/comments", "{\"body\":\"First\"}");
+      int id = root.get("id").asInt();
+      assertThat(root.get("authorUserId").asText()).isEqualTo("alice");
+      ok("POST", "/records/document/1/comments", "{\"body\":\"Second\"}");
+      JsonNode page = ok("GET", "/records/document/1/comments?limit=1", null);
+      assertThat(page.get("threads")).hasSize(1);
+      String cursor = page.get("nextCursor").asText();
+      JsonNode next = ok("GET", "/records/document/1/comments?limit=1&cursor=" + cursor, null);
+      assertThat(next.at("/threads/0/id").asInt()).isEqualTo(id);
+      assertThat(next.get("nextCursor").isNull()).isTrue();
+      ok("POST", "/records/document/1/comments", "{\"body\":\"Reply\",\"parentCommentId\":" + id + "}");
+      assertThat(ok("GET", "/records/document/1/comments", null).at("/threads/0/replies")).hasSize(1);
+      ok("PATCH", "/comments/" + id, "{\"body\":\"Edited @[Alice](user:alice)\"}");
+      assertThat(ok("GET", "/comments/" + id + "/history", null).at("/items/0/body").asText()).isEqualTo("First");
+      ok("POST", "/comments/" + id + "/resolve", null);
+      assertThat(ok("GET", "/records/document/1/comments", null).at("/threads/0/resolved").asBoolean()).isTrue();
+      ok("POST", "/comments/" + id + "/reopen", null);
+      assertThat(ok("GET", "/records/document/1/comments", null).at("/threads/0/resolved").asBoolean()).isFalse();
+      JsonNode people = ok("GET", "/people?q=alice", null);
+      assertThat(people.at("/items/0/userId").asText()).isEqualTo("alice");
+      assertThat(ok("GET", "/people/alice", null).get("displayName").asText()).isEqualTo("alice");
+      JsonNode candidate = ok("GET", "/mentions/candidates?table=document&pk=1&q=alice", null).at("/items/0");
+      assertThat(candidate.at("/person/userId").asText()).isEqualTo("alice");
+      assertThat(candidate.get("canRead").asText()).isEqualTo("unknown");
+      assertThat(ok("GET", "/records/document/1/follow", null).at("/follow/reason").asText()).isEqualTo("COMMENTED");
+      JsonNode state = ok("PUT", "/records/document/1/follow", "{\"notifyOnChange\":false,\"notifyOnComment\":true}");
+      assertThat(state.at("/follow/notifyOnChange").asBoolean()).isFalse();
+      assertThat(ok("GET", "/records/document/1/followers", null).at("/items/0/userId").asText()).isEqualTo("alice");
+      JsonNode timeline = ok("GET", "/records/document/1/timeline?limit=1&types=ACTIVITY", null);
+      assertThat(timeline.get("items")).hasSize(1);
+      assertThat(timeline.at("/items/0/kind").asText()).isEqualTo("ACTIVITY");
+      String before = timeline.get("nextCursor").asText();
+      JsonNode older = ok("GET", "/records/document/1/timeline?before=" + before + "&types=ACTIVITY", null);
+      assertThat(older.at("/items/0/id").asLong()).isNotEqualTo(timeline.at("/items/0/id").asLong());
+      ok("DELETE", "/comments/" + id, null);
+      assertThat(ok("GET", "/records/document/1/comments", null).at("/threads/0/deleted").asBoolean()).isTrue();
+      ok("DELETE", "/records/document/1/follow", null);
+      assertThat(ok("GET", "/records/document/1/follow", null).get("follow").isNull()).isTrue();
+      assertError(404, "GET", "/people/missing", null, "alice");
+      assertError(403, "PATCH", "/comments/" + id, "{\"body\":\"no\"}", "reader");
+      assertError(400, "GET", "/records/document/1/timeline?cursor=" + cursor, null, "alice");
+   }
+
+   /*******************************************************************************
+    ** Missing and locked parents are indistinguishable, across all record panels.
+    *******************************************************************************/
+   @Test
+   void authorizationAndValidation() throws Exception
+   {
+      for(String feature : List.of("attachments", "tags", "comments", "follow", "followers", "timeline"))
+      {
+         HttpResponse<String> hidden = request("GET", "/records/document/3/" + feature, null, "alice");
+         HttpResponse<String> absent = request("GET", "/records/document/999/" + feature, null, "alice");
+         assertThat(hidden.statusCode()).isEqualTo(404);
+         assertThat(hidden.body()).isEqualTo(absent.body());
+         assertThat(json(hidden, 404).get("error").asText()).isEqualTo("Not found");
+      }
+      assertError(404, "POST", "/records/document/3/comments", "not json", "alice");
+      assertError(404, "GET", "/mentions/candidates?table=document&pk=3", null, "alice");
+      assertError(403, "POST", "/records/document/1/comments", "{\"body\":\"Denied\"}", "reader");
+      assertError(400, "POST", "/records/document/1/comments", "{\"body\":\"\"}", "alice");
+      for(String body : List.of("not json", "[]", "null", "{\"body\":42}\", \"{}"))
+      {
+         assertError(400, "POST", "/records/document/1/comments", body, "alice");
+      }
+      for(String limit : List.of("0", "101", "bad"))
+      {
+         assertError(400, "GET", "/records/document/1/comments?limit=" + limit, null, "alice");
+      }
+      ok("GET", "/records/document/1/comments?limit=100", null);
+      ok("GET", "/records/document/1/timeline?limit=100", null);
+      ok("GET", "/people?limit=100", null);
+      assertError(400, "GET", "/records/document/1/comments?cursor=invalid", null, "alice");
+      assertError(400, "GET", "/records/document/1/timeline?before=a&cursor=b", null, "alice");
+      assertError(400, "GET", "/tags", null, "alice");
+      assertError(400, "GET", "/comments/invalid/history", null, "alice");
+      assertError(404, "GET", "/comments/999/history", null, "alice");
+   }
+
+   /*******************************************************************************
+    ** Send JSON with a persistent caller cookie; credentials travel over HTTP.
+    *******************************************************************************/
+   private HttpResponse<String> request(String method, String path, String body, String caller) throws Exception
+   {
+      return (client.send(HttpRequest.newBuilder(URI.create(baseUrl + path)).timeout(Duration.ofSeconds(20))
+         .header("Cookie", "sessionUUID=" + caller + sessionSuffix).header("Content-Type", "application/json")
+         .method(method, body == null ? HttpRequest.BodyPublishers.noBody() : HttpRequest.BodyPublishers.ofString(body)).build(), HttpResponse.BodyHandlers.ofString()));
+   }
+
+   /*******************************************************************************
+    ** Assert transport status before interpreting the returned wire body.
+    *******************************************************************************/
+   private JsonNode json(HttpResponse<String> response, int status) throws Exception
+   {
+      assertThat(response.statusCode()).as(response.body()).isEqualTo(status);
+      return (JSON.readTree(response.body()));
+   }
+
+   /*******************************************************************************
+    ** Successful request by the record author.
+    *******************************************************************************/
+   private JsonNode ok(String method, String path, String body) throws Exception
+   {
+      return (json(request(method, path, body, "alice"), 200));
+   }
+
+   /*******************************************************************************
+    ** The live server publishes the same typed extension that its routes execute.
+    *******************************************************************************/
+   @Test
+   void publishedDescription() throws Exception
+   {
+      String serverUrl = baseUrl.substring(0, baseUrl.indexOf("/qqq/"));
+      JsonNode description = json(client.send(HttpRequest.newBuilder(URI.create(serverUrl + "/qqq/v1/openapi.json")).GET().build(),
+         HttpResponse.BodyHandlers.ofString()), 200);
+      JsonNode schemas = description.at("/components/schemas");
+      assertThat(schemas.has("CollaborationCommentPageV1")).isTrue();
+      assertThat(schemas.at("/CollaborationFollowV1/properties/reason/enum")).hasSize(6);
+      assertThat(description.get("paths").has("/qqq/v1/qbit/collaboration/records/{table}/{pk}/attachments")).isTrue();
+      assertThat(description.get("paths").has("/qqq/v1/qbit/collaboration/my-work")).isTrue();
+      JsonNode version = json(client.send(HttpRequest.newBuilder(URI.create(serverUrl + "/qqq/v1/version")).GET().build(),
+         HttpResponse.BodyHandlers.ofString()), 200);
+      assertThat(version.at("/extensions/0/name").asText()).isEqualTo("collaboration");
+      assertThat(version.at("/extensions/0/version").asText()).isEqualTo("1.0.0");
+   }
+
+   /*******************************************************************************
+    ** Framework errors always contain a human-readable error property.
+    *******************************************************************************/
+   private void assertError(int status, String method, String path, String body, String caller) throws Exception
+   {
+      assertThat(json(request(method, path, body, caller), status).get("error").asText()).isNotBlank();
+   }
+
+   /*******************************************************************************
+    ** Build an actual multipart body without filesystem fixtures.
+    *******************************************************************************/
+   private HttpResponse<String> upload(String caller, String name, String content, String path) throws Exception
+   {
+      String boundary = "CollaborationBoundary";
+      String payload = "--" + boundary + "\r\nContent-Disposition: form-data; name=\"description\"\r\n\r\nA report\r\n"
+         + "--" + boundary + "\r\nContent-Disposition: form-data; name=\"file\"; filename=\"" + name + "\"\r\nContent-Type: text/plain\r\n\r\n"
+         + content + "\r\n--" + boundary + "--\r\n";
+      return (client.send(HttpRequest.newBuilder(URI.create(baseUrl + path)).timeout(Duration.ofSeconds(20))
+         .header("Cookie", "sessionUUID=" + caller + sessionSuffix).header("Content-Type", "multipart/form-data; boundary=" + boundary)
+         .POST(HttpRequest.BodyPublishers.ofString(payload)).build(), HttpResponse.BodyHandlers.ofString()));
+   }
+
+   /*******************************************************************************
+    ** Test auth maps stable cookies to distinct users, grants and tenant locks.
+    *******************************************************************************/
+   public static class TestSessions implements QAuthenticationModuleCustomizerInterface
+   {
+      @Override
+      public void customizeSession(QInstance qInstance, QSession session, Map<String, Object> context)
+      {
+         String caller = session.getUuid().split("-")[0];
+         session.withUser(new QUser().withIdReference(caller).withFullName(caller));
+         session.withPermissions("document.read").withSecurityKeyValue("tenant", caller.equals("outsider") ? "b" : "a");
+         if(caller.equals("alice"))
+         {
+            session.withPermissions("document.write");
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Public no-arg adapter loaded through host configuration, with in-memory bytes.
+    *******************************************************************************/
+   public static class MemoryStorage extends AttachmentStorage
+   {
+      static final Map<String, byte[]> objects = new ConcurrentHashMap<>();
+      static volatile PresignGet lastGet;
+      static volatile boolean fail;
+
+      @Override
+      public long maxBytes(String name)
+      {
+         return (1000000);
+      }
+
+      @Override
+      public void put(String name, PutRequest request)
+      {
+         try
+         {
+            objects.put(request.getKey(), request.getStream().readAllBytes());
+         }
+         catch(IOException e)
+         {
+            throw (new IllegalStateException(e));
+         }
+      }
+
+      @Override
+      public void delete(String name, String key)
+      {
+         objects.remove(key);
+      }
+
+      @Override
+      public URL presign(String name, PresignGet request)
+      {
+         if(fail)
+         {
+            throw (new IllegalStateException("Test provider unavailable"));
+         }
+         lastGet = request;
+         try
+         {
+            return (URI.create("https://files.example.invalid/" + request.getKey()).toURL());
+         }
+         catch(Exception e)
+         {
+            throw (new IllegalStateException(e));
+         }
+      }
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/ConversationServicesTest.java

@@ -44,8 +44,8 @@ import com.kingsrook.qbits.collaboration.notify.NoOpNotifier;
 import com.kingsrook.qbits.collaboration.notify.RecordingNotifier;
 import com.kingsrook.qbits.collaboration.people.PeopleService;
 import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
-import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
-import com.kingsrook.qbits.collaboration.security.UserSessionSupplier;
+import com.kingsrook.qbits.collaboration.security.CollaborationRecordAccessChecker;
+import com.kingsrook.qqq.backend.core.actions.collaboration.UserSessionProviderInterface;
 import com.kingsrook.qqq.backend.core.actions.QBackendTransaction;
 import com.kingsrook.qqq.backend.core.actions.processes.RunProcessAction;
 import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
@@ -101,7 +101,7 @@ public class ConversationServicesTest extends PersonalServiceFixture
       sessions.put("bob", session("bob", "a"));
       sessions.put("eve", session("eve", "b"));
       sessions.put("alice", session("alice", "a"));
-      config.withNotifier(new QCodeReference(TestNotifier.class)).withUserSessionSupplier(new QCodeReference(TestSessions.class));
+      config.withNotifier(new QCodeReference(TestNotifier.class)).withUserSessionProvider(new QCodeReference(TestSessions.class));
       QContext.getQSession().getUser().setFullName("Alice Example");
       new QInstanceValidator().validate(instance);
    }
@@ -121,10 +121,10 @@ public class ConversationServicesTest extends PersonalServiceFixture
    /*******************************************************************************
     ** The provider returns explicit test identities with real record locks.
     *******************************************************************************/
-   public static class TestSessions implements UserSessionSupplier
+   public static class TestSessions implements UserSessionProviderInterface
    {
       @Override
-      public Optional<QSession> sessionFor(String userId)
+      public Optional<QSession> sessionForUser(String userId)
       {
          return (Optional.ofNullable(sessions.get(userId)));
       }
@@ -166,11 +166,11 @@ public class ConversationServicesTest extends PersonalServiceFixture
       });
       comments.edit(entry.id(), "Again @[Bob](user:bob)");
       assertThat(recorder.notifications()).hasSize(1);
-      config.withUserSessionSupplier(null);
+      config.withUserSessionProvider(null);
       CommentEntry unknown = comments.post("document", 2, "@[Bob](user:bob)", null, null);
       assertThat(unknown.mentions()).containsExactly(new MentionEntry("bob", false));
       assertThat(recorder.notifications()).hasSize(1);
-      assertThat(new OtherUserAccess().canRead("bob", "document", 1)).isEmpty();
+      assertThat(new CollaborationRecordAccessChecker().canRead("bob", "document", 1)).isEmpty();
    }
 
    /*******************************************************************************
@@ -197,7 +197,7 @@ public class ConversationServicesTest extends PersonalServiceFixture
       assertThat(recorder.notifications()).hasSize(1);
       QContext.clearTransaction();
       sessions.put("bob", session("wrong-user", "a"));
-      assertThat(new OtherUserAccess().canRead("bob", "document", 1)).isEmpty();
+      assertThat(new CollaborationRecordAccessChecker().canRead("bob", "document", 1)).isEmpty();
       new NoOpNotifier().notify(recorder.notifications().getFirst());
    }
 
@@ -296,7 +296,7 @@ public class ConversationServicesTest extends PersonalServiceFixture
       comments.post("document", 1, "new reply", first.id(), null);
       assertThat(comments.list("document", 1, null, 1).threads().getFirst().id()).isEqualTo(first.id());
       assertThatThrownBy(() -> comments.list("document", 1, "bad!", 20)).hasMessage("Invalid cursor");
-      assertThatThrownBy(() -> comments.list("document", 1, null, 51)).hasMessageContaining("Limit");
+      assertThatThrownBy(() -> comments.list("document", 1, null, 101)).hasMessageContaining("Limit");
       assertThatThrownBy(() -> comments.post("document", 1, " ", null, null)).hasMessageContaining("body");
       assertThatThrownBy(() -> comments.post("document", 1, "a".repeat(20001), null, null)).hasMessageContaining("body");
       assertThatThrownBy(() -> comments.post("document", 1, "ok", null, "missing")).hasMessage("Unknown field");
@@ -363,7 +363,7 @@ public class ConversationServicesTest extends PersonalServiceFixture
       assertThat(comments.mentionCandidates("document", 1, "eve").getFirst().canRead()).contains(false);
       CollaborationRecords.update(CollaborationTables.USER, new QRecord().withValue("id", eve.getValue("id")).withValue("active", false));
       assertThat(new PeopleService().search("eve", 50)).isEmpty();
-      assertThatThrownBy(() -> new PeopleService().search("", 51)).hasMessageContaining("Limit");
+      assertThatThrownBy(() -> new PeopleService().search("", 101)).hasMessageContaining("Limit");
    }
 
    /*******************************************************************************
@@ -493,7 +493,7 @@ public class ConversationServicesTest extends PersonalServiceFixture
       new CollaborationQBitProducer().withQBitConfig(configured).produce(installed);
       assertThat(installed.getProcess("collaborationFollow_document").getLabel()).isEqualTo("Follow");
       assertThat(installed.getProcess("collaborationUnfollow_document").getLabel()).isEqualTo("Unfollow");
-      assertThat(installed.getRecordChangeListeners()).hasSize(2);
+      assertThat(installed.getRecordChangeListeners()).hasSize(3);
       assertThat(installed.getProcess("collaborationAddTags_document").getLabel()).isEqualTo("Add tags");
       assertThat(installed.getProcess("collaborationRemoveTags_document").getLabel()).isEqualTo("Remove tags");
       assertThat(installed.getProcess(SendFollowDigestsProcess.NAME).getSchedule().getRepeatSeconds()).isEqualTo(60);

src/test/java/com/kingsrook/qbits/collaboration/CoreContractsTest.java

@@ -0,0 +1,202 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.util.List;
+import java.util.ArrayList;
+import java.util.concurrent.CopyOnWriteArrayList;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qbits.collaboration.tags.TagsService;
+import com.kingsrook.qqq.backend.core.actions.QBackendTransaction;
+import com.kingsrook.qqq.backend.core.actions.collaboration.RecordFeaturesResolver;
+import com.kingsrook.qqq.backend.core.actions.collaboration.RecordFeatureSummaryHelper;
+import com.kingsrook.qqq.backend.core.actions.collaboration.RuntimeMetaDataOverlay;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeature;
+import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeaturesMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.security.RecordSecurityLock;
+import com.kingsrook.qqq.backend.core.model.metadata.security.QSecurityKeyType;
+import com.kingsrook.qqq.backend.core.realtime.RealtimeBus;
+import com.kingsrook.qqq.backend.core.realtime.RealtimeMessage;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/*******************************************************************************
+ ** Core contract integration, using real action and metadata resolution paths.
+ *******************************************************************************/
+class CoreContractsTest extends PersonalServiceFixture
+{
+   /*******************************************************************************
+    ** Instance defaults and table-specific declarations follow core precedence.
+    *******************************************************************************/
+   @Test
+   void defaultsAndTableDeclarations() throws Exception
+   {
+      var configured = new CollaborationQBitConfig().withTableFeatures("document", RecordFeature.TAGS);
+      instance.getSupplementalMetaData().remove(RecordFeaturesMetaData.NAME);
+      configured.applyFeatures(instance);
+      assertThat(RecordFeaturesMetaData.of(instance).getEnabled()).containsEntry(RecordFeature.FAVORITES, true)
+         .containsEntry(RecordFeature.RECENTS, true).containsEntry(RecordFeature.TIMELINE, true).containsEntry(RecordFeature.COMMENTS, false);
+      RuntimeMetaDataOverlay.refresh(instance);
+      assertThat(RecordFeaturesResolver.resolve(instance, instance.getTable("document")).enabledFeatures()).containsExactly(RecordFeature.TAGS);
+   }
+
+   /*******************************************************************************
+    ** Committed policy refreshes the overlay while rollback publishes no generation.
+    *******************************************************************************/
+   @Test
+   void settingsRefreshAfterCommitAndDeleteRestoresDefaults() throws Exception
+   {
+      admin();
+      RuntimeMetaDataOverlay.refresh(instance);
+      long generation = RuntimeMetaDataOverlay.getGeneration(instance);
+      assertThat(instance.getTable("document").getVirtualFields()).containsKey("collaborationTags");
+      assertThat(instance.getTable("document").getVirtualField("collaborationTags").getIsQuerySelectable()).isFalse();
+      QBackendTransaction tx = new QBackendTransaction();
+      var row = new InsertAction().execute(new InsertInput(CollaborationTables.FEATURE_SETTING).withTransaction(tx).withRecords(List.of(
+         new QRecord().withValue("scopeType", "TABLE").withValue("scopeName", "document").withValue("feature", "TAGS")
+            .withValue("enabled", false).withValue("settings", "{\"mode\":\"APPROVED_ONLY\"}")))).getRecords().getFirst();
+      assertThat(row.getErrors()).isNullOrEmpty();
+      assertThat(RuntimeMetaDataOverlay.getGeneration(instance)).isEqualTo(generation);
+      tx.commit();
+      assertThat(RuntimeMetaDataOverlay.getGeneration(instance)).isGreaterThan(generation);
+      assertThat(RecordFeaturesResolver.resolve(instance, instance.getTable("document")).isEnabled(RecordFeature.TAGS)).isFalse();
+      assertThat(instance.getTable("document").getVirtualFields()).doesNotContainKey("collaborationTags");
+      new UpdateAction().execute(new UpdateInput(CollaborationTables.FEATURE_SETTING).withRecords(List.of(new QRecord().withValue("id", row.getValue("id")).withValue("enabled", true))));
+      assertThat(instance.getTable("document").getVirtualFields()).containsKey("collaborationTags");
+      new DeleteAction().execute(new DeleteInput(CollaborationTables.FEATURE_SETTING).withPrimaryKeys(List.of(row.getValue("id"))));
+      assertThat(RecordFeaturesResolver.resolve(instance, instance.getTable("document")).isEnabled(RecordFeature.TAGS)).isTrue();
+      generation = RuntimeMetaDataOverlay.getGeneration(instance);
+      tx = new QBackendTransaction();
+      new FeatureSettingsCustomizer().postInsert(new InsertInput(CollaborationTables.FEATURE_SETTING).withTransaction(tx), List.of());
+      tx.rollback();
+      assertThat(RuntimeMetaDataOverlay.getGeneration(instance)).isEqualTo(generation);
+   }
+
+   /*******************************************************************************
+    ** Implied grants require WRITE locks; explicit feature grants retain READ checks.
+    *******************************************************************************/
+   @Test
+   void impliedFeatureGrantChecksWriteLocks() throws Exception
+   {
+      instance.addSecurityKeyType(new QSecurityKeyType().withName("editor"));
+      instance.getTable("document").withRecordSecurityLock(new RecordSecurityLock().withFieldName("tenant")
+         .withSecurityKeyType("editor").withLockScope(RecordSecurityLock.LockScope.WRITE));
+      QContext.getQSession().withSecurityKeyValue("editor", "b");
+      assertThat(ParentRecordAccess.requireVisibleParent("document", 1)).isNotNull();
+      assertThatThrownBy(() -> ParentRecordAccess.requireFeature("document", 1, "comment")).isInstanceOf(QPermissionDeniedException.class);
+      QContext.getQSession().withPermissions("document.comment");
+      ParentRecordAccess.requireFeature("document", 1, "comment");
+   }
+
+   /*******************************************************************************
+    ** Configured mirrors are generated, populated and updated by core.
+    *******************************************************************************/
+   @Test
+   void mirrorsAndSchemaUseConfiguredKeys() throws Exception
+   {
+      config.withMirroredSecurityKeyTypes(List.of("tenant"));
+      var security = com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordReferenceSecurityConfig.of(instance);
+      security.withMirroredSecurityKeyTypes(List.of("tenant"));
+      for(var table : instance.getTables().values())
+      {
+         CoreCollaboration.reference(table, config);
+      }
+      var comment = new com.kingsrook.qbits.collaboration.comments.CommentsService().post("document", 1, "Hello", null, null);
+      var row = CollaborationRecords.query(CollaborationTables.COMMENT, new QQueryFilter()).getFirst();
+      assertThat(row.getValueString("lockKey_tenant")).isEqualTo("a");
+      assertThat(CollaborationSchema.postgresScript(config)).contains("lock_key_tenant", "ADD COLUMN IF NOT EXISTS lock_key_tenant");
+      QContext.getQSession().withSecurityKeyValue("allTenants", true);
+      new UpdateAction().execute(new UpdateInput("document").withRecords(List.of(new QRecord().withValue("id", 1).withValue("tenant", "b"))));
+      assertThat(CollaborationRecords.cleanupQuery(CollaborationTables.COMMENT, new QQueryFilter()).getFirst().getValueString("lockKey_tenant")).isEqualTo("b");
+      login("alice");
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.RECORD_TAG)).getRecords()).isEmpty();
+      assertThat(comment.id()).isPositive();
+   }
+
+   /*******************************************************************************
+    ** Core query expansion and summaries expose the same persisted collaboration state.
+    *******************************************************************************/
+   @Test
+   void virtualTagCriteriaAndSummary() throws Exception
+   {
+      RuntimeMetaDataOverlay.refresh(instance);
+      var tag = new TagsService().create("document", "Urgent", null);
+      new TagsService().apply("document", 1, List.of(tag.id()), List.of());
+      var matches = new QueryAction().execute(new QueryInput("document").withFilter(new QQueryFilter()
+         .withCriteria("collaborationTags", QCriteriaOperator.EQUALS, tag.id()))).getRecords();
+      assertThat(matches).extracting(row -> row.getValueInteger("id")).containsExactly(1);
+      new com.kingsrook.qbits.collaboration.comments.CommentsService().post("document", 1, "Hello", null, null);
+      new com.kingsrook.qbits.collaboration.tasks.TasksService().create("document", 1, "Review", null, null, null, null);
+      new com.kingsrook.qbits.collaboration.assignment.AssignmentService().assign("document", 1, "alice", "alice");
+      var summary = RecordFeatureSummaryHelper.summarize(instance.getTable("document"), ParentRecordAccess.requireVisibleParent("document", 1));
+      assertThat(summary.getCounts()).containsEntry("tags", 1).containsEntry("openComments", 1).containsEntry("openTasks", 1).containsEntry("attachments", 0).containsEntry("followers", 1);
+      assertThat(summary.getIsFollowing()).isTrue();
+      assertThat(summary.getIsFavorite()).isFalse();
+      assertThat(summary.getOwner()).isEqualTo("alice");
+      assertThat(summary.getAssignee()).isEqualTo("alice");
+   }
+
+   /*******************************************************************************
+    ** Realtime hints contain identifiers and obey commit/rollback boundaries.
+    *******************************************************************************/
+   @Test
+   void realtimeCommitsAndRollbackDiscardsHints() throws Exception
+   {
+      List<RealtimeMessage> messages = new CopyOnWriteArrayList<>();
+      try(var subscription = RealtimeBus.get(instance).subscribe(messages::add))
+      {
+         var tx = new QBackendTransaction();
+         QContext.setTransaction(tx);
+         var comment = new com.kingsrook.qbits.collaboration.comments.CommentsService().post("document", 1, "Private body", null, null);
+         assertThat(messages).noneMatch(message -> message.getEvent().equals("comment.added"));
+         tx.commit();
+         QContext.clearTransaction();
+         assertThat(messages).anyMatch(message -> message.getEvent().equals("comment.added") && message.getChannel().equals("record:document:1"));
+         assertThat(messages).allSatisfy(message -> assertThat(message.getData().toString()).doesNotContain("Private body"));
+         messages.clear();
+         tx = new QBackendTransaction();
+         QContext.setTransaction(tx);
+         new com.kingsrook.qbits.collaboration.comments.CommentsService().edit(comment.id(), "Changed");
+         tx.rollback();
+         QContext.clearTransaction();
+         assertThat(messages).noneMatch(message -> message.getEvent().equals("comment.updated"));
+         new com.kingsrook.qbits.collaboration.comments.CommentsService().edit(comment.id(), "Committed");
+         assertThat(messages).anyMatch(message -> message.getEvent().equals("comment.updated"));
+      }
+      RealtimeBus.close(instance);
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/PersonalServiceFixture.java

@@ -68,7 +68,7 @@ public abstract class PersonalServiceFixture
       instance = new QInstance().withInstanceDefaultAuthentication(new QAuthenticationMetaData().withName("anonymous").withType(QAuthenticationType.FULLY_ANONYMOUS));
       instance.addBackend(new QBackendMetaData().withName("memory").withBackendType(MemoryBackendModule.class));
       instance.setEnforcePermissionsInCoreActions(true);
-      config = new CollaborationQBitConfig().withBackendName("memory");
+      config = new CollaborationQBitConfig().withBackendName("memory").withDefaultFeatures(com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFeature.values());
       new CollaborationQBitProducer().withQBitConfig(config).produce(instance);
       instance.addSecurityKeyType(new QSecurityKeyType().withName("tenant").withAllAccessKeyName("allTenants"));
       instance.addTable(new QTableMetaData().withName("document").withLabel("Documents").withBackendName("memory").withPrimaryKeyField("id")
@@ -79,6 +79,7 @@ public abstract class PersonalServiceFixture
          .withRecordLabelFormatAndFields("%s", "title")
          .withRecordSecurityLock(new RecordSecurityLock().withFieldName("tenant").withSecurityKeyType("tenant")
             .withLockScope(RecordSecurityLock.LockScope.READ_AND_WRITE)));
+      new com.kingsrook.qqq.backend.core.instances.QInstanceEnricher(instance).enrich();
       login("alice");
       QContext.getQSession().withSecurityKeyValue("allTenants", true);
       InsertInput insert = new InsertInput("document").withRecords(List.of(

src/test/java/com/kingsrook/qbits/collaboration/SharingWorkTest.java

@@ -40,7 +40,7 @@ import com.kingsrook.qbits.collaboration.mywork.MyWorkService;
 import com.kingsrook.qbits.collaboration.notify.CollaborationNotification;
 import com.kingsrook.qbits.collaboration.notify.CollaborationNotifier;
 import com.kingsrook.qbits.collaboration.notify.RecordingNotifier;
-import com.kingsrook.qbits.collaboration.security.UserSessionSupplier;
+import com.kingsrook.qqq.backend.core.actions.collaboration.UserSessionProviderInterface;
 import com.kingsrook.qbits.collaboration.sharing.AccessRequestService;
 import com.kingsrook.qbits.collaboration.sharing.PermissionHolderDirectory;
 import com.kingsrook.qbits.collaboration.sharing.SharingService;
@@ -102,7 +102,7 @@ public class SharingWorkTest extends PersonalServiceFixture
       sessions.put("alice", session("alice", "a"));
       sessions.put("bob", session("bob", "a"));
       sessions.put("eve", session("eve", "b"));
-      config.withNotifier(new QCodeReference(TestNotifier.class)).withUserSessionSupplier(new QCodeReference(TestSessions.class));
+      config.withNotifier(new QCodeReference(TestNotifier.class)).withUserSessionProvider(new QCodeReference(TestSessions.class));
       QContext.getQSession().getUser().setFullName("Alice");
       CollaborationRecords.insert(CollaborationTables.USER, new QRecord().withValue("userId", "eve").withValue("displayName", "Sam"));
       WorkProcesses.assignments("document").forEach(instance::addProcess);
@@ -127,13 +127,13 @@ public class SharingWorkTest extends PersonalServiceFixture
    /*******************************************************************************
     ** Test Sessions.
     *******************************************************************************/
-   public static class TestSessions implements UserSessionSupplier
+   public static class TestSessions implements UserSessionProviderInterface
    {
       /*******************************************************************************
        ** Use the configured test boundary.
        *******************************************************************************/
       @Override
-      public Optional<QSession> sessionFor(String user)
+      public Optional<QSession> sessionForUser(String user)
       {
          return (Optional.ofNullable(sessions.get(user)));
       }
@@ -310,7 +310,7 @@ public class SharingWorkTest extends PersonalServiceFixture
       QRecord soon = tasks.create("document", 1, "Soon", null, null, NOW.plusSeconds(3600), null);
       assertThat(soon.getValueInstant("remindAt")).isEqualTo(soon.getValueInstant("dueAt"));
       assertThat(soon.getValueString("assigneeUserId")).isEqualTo("alice");
-      config.withUserSessionSupplier(null);
+      config.withUserSessionProvider(null);
       assertThat(tasks.create("document", 1, "Self", null, null, null, null).getValueInstant("remindAt")).isNull();
    }
 

src/test/java/com/kingsrook/qbits/collaboration/TagsServiceTest.java

@@ -30,7 +30,7 @@ import com.kingsrook.qbits.collaboration.app.CollaborationHome;
 import com.kingsrook.qbits.collaboration.attachments.AttachmentCleanup;
 import com.kingsrook.qbits.collaboration.model.CollaborationTables;
 import com.kingsrook.qbits.collaboration.tags.TagEntry;
-import com.kingsrook.qbits.collaboration.tags.TagFilterTranslator;
+
 import com.kingsrook.qbits.collaboration.tags.TagProcesses;
 import com.kingsrook.qbits.collaboration.tags.TagsService;
 import com.kingsrook.qqq.backend.core.actions.processes.RunProcessAction;
@@ -72,7 +72,7 @@ import static org.assertj.core.api.Assertions.assertThatThrownBy;
 public class TagsServiceTest extends PersonalServiceFixture
 {
    private final TagsService tags = new TagsService();
-   private final TagFilterTranslator filters = new TagFilterTranslator();
+
 
    /*******************************************************************************
     ** Natural keys are locale-independent and validate after collapsing whitespace.
@@ -257,23 +257,23 @@ public class TagsServiceTest extends PersonalServiceFixture
       TagEntry b = tags.create("document", "B", null);
       tags.apply("document", 1, List.of(a.id(), b.id()), List.of());
       tags.apply("document", 2, List.of(a.id()), List.of());
-      assertThat(filters.recordIds("document", "IN", List.of("A"))).containsExactly("1", "2");
-      assertThat(filters.recordIds("document", "IN", List.of(b.id()))).containsExactly("1");
-      assertThat(filters.recordIds("document", "CONTAINS_ALL", List.of(a.id(), b.id(), a.id()))).containsExactly("1");
-      assertThat(filters.recordIds("document", "CONTAINS_ALL", List.of(a.id(), "unknown"))).isEmpty();
-      assertThat(filters.recordIds("document", "NOT_IN", List.of(b.id()))).containsExactly("2");
-      assertThat(filters.recordIds("document", "IS_NOT_BLANK", null)).containsExactly("1", "2");
-      assertThat(filters.recordIds("document", "IS_BLANK", null)).isEmpty();
+      assertThat(recordIds("document", "IN", List.of("A"))).containsExactly("1", "2");
+      assertThat(recordIds("document", "IN", List.of(b.id()))).containsExactly("1");
+      assertThat(recordIds("document", "CONTAINS_ALL", List.of(a.id(), b.id(), a.id()))).containsExactly("1");
+      assertThat(recordIds("document", "CONTAINS_ALL", List.of(a.id(), "unknown"))).isEmpty();
+      assertThat(recordIds("document", "NOT_IN", List.of(b.id()))).containsExactly("2");
+      assertThat(recordIds("document", "IS_NOT_BLANK", null)).containsExactly("1", "2");
+      assertThat(recordIds("document", "IS_BLANK", null)).isEmpty();
       tags.apply("document", 2, List.of(), List.of(a.id()));
-      assertThat(filters.recordIds("document", "IS_BLANK", List.of())).containsExactly("2");
-      assertThat(filters.recordIds("document", "IN", List.of())).isEmpty();
-      assertThat(filters.recordIds("document", "NOT_IN", List.of("unknown"))).containsExactly("1", "2");
-      assertThat(filters.recordIds("document", "CONTAINS_ALL", List.of())).containsExactly("1", "2");
-      assertThatThrownBy(() -> filters.recordIds("document", "LIKE", List.of())).hasMessageContaining("Unsupported");
+      assertThat(recordIds("document", "IS_BLANK", List.of())).containsExactly("2");
+      assertThat(recordIds("document", "IN", List.of())).isEmpty();
+      assertThat(recordIds("document", "NOT_IN", List.of("unknown"))).containsExactly("1", "2");
+      assertThat(recordIds("document", "CONTAINS_ALL", List.of())).containsExactly("1", "2");
+      assertThatThrownBy(() -> recordIds("document", "LIKE", List.of())).hasMessageContaining("Unsupported");
    }
 
    /*******************************************************************************
-    ** Exactly 10,000 is allowed; the next matching id fails instead of truncating.
+    ** The core bound applies to subquery rows, not the number of matching parents.
     *******************************************************************************/
    @Test
    void translatorCap() throws Exception
@@ -284,9 +284,9 @@ public class TagsServiceTest extends PersonalServiceFixture
          parents.add(new QRecord().withValue("id", id).withValue("tenant", "a"));
       }
       new InsertAction().execute(new InsertInput("document").withRecords(parents));
-      assertThat(filters.recordIds("document", "IS_BLANK", null)).hasSize(10000);
+      assertThat(recordIds("document", "IS_BLANK", null)).hasSize(10000);
       new InsertAction().execute(new InsertInput("document").withRecords(List.of(new QRecord().withValue("id", 10002).withValue("tenant", "a"))));
-      assertThatThrownBy(() -> filters.recordIds("document", "IS_BLANK", null)).hasMessageContaining("10,000");
+      assertThat(recordIds("document", "IS_BLANK", null)).hasSize(10001);
    }
 
    /*******************************************************************************
@@ -445,4 +445,24 @@ public class TagsServiceTest extends PersonalServiceFixture
    {
       return ((List<ProcessSummaryLine>) output.getValues().get(result ? StreamedETLWithFrontendProcess.FIELD_PROCESS_SUMMARY : StreamedETLWithFrontendProcess.FIELD_VALIDATION_SUMMARY));
    }
+   /*******************************************************************************
+    ** Execute expanded criteria through the real parent query action.
+    *******************************************************************************/
+   private List<String> recordIds(String table, String operator, java.util.Collection<? extends java.io.Serializable> values) throws Exception
+   {
+      var metadata = instance.getTable(table);
+      com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator op;
+      try
+      {
+         op = com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator.valueOf(operator);
+      }
+      catch(IllegalArgumentException e)
+      {
+         throw new IllegalArgumentException("Unsupported operator");
+      }
+      var filter = new com.kingsrook.qbits.collaboration.tags.TagCriteriaExpander().expand(metadata,
+         new com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria("collaborationTags", op,
+            new java.util.ArrayList<java.io.Serializable>(values == null ? List.of() : values)), null);
+      return (new QueryAction().execute(new QueryInput(table).withFilter(filter)).getRecords().stream().map(row -> row.getValueString("id")).toList());
+   }
 }

src/test/java/com/kingsrook/qbits/collaboration/TimelineServiceTest.java

@@ -134,7 +134,7 @@ public class TimelineServiceTest extends PersonalServiceFixture
       assertThat(timeline.timeline("document", 1, null, 50, null).items()).hasSize(3).allSatisfy(item -> assertThat(item.kind()).isEqualTo("ACTIVITY"));
       assertThatThrownBy(() -> timeline.timeline("document", 3, null, 50, null)).hasMessage("Not found");
       assertThatThrownBy(() -> timeline.timeline("document", 1, "invalid", 50, null)).hasMessage("Invalid cursor");
-      assertThatThrownBy(() -> timeline.timeline("document", 1, null, 51, null)).hasMessageContaining("Limit");
+      assertThatThrownBy(() -> timeline.timeline("document", 1, null, 101, null)).hasMessageContaining("Limit");
       instance.getTables().remove("audit");
       assertThat(timeline.timeline("document", 1, null, 50, Set.of("AUDIT")).items()).isEmpty();
    }

src/test/java/com/kingsrook/qbits/collaboration/attachments/AttachmentsServiceTest.java

@@ -202,6 +202,7 @@ public class AttachmentsServiceTest extends PersonalServiceFixture
       QContext.getQSession().getPermissions().remove("document.write");
       assertThatThrownBy(() -> service.delete(List.of(bob.id()))).isInstanceOf(QPermissionDeniedException.class);
       admin();
+      QContext.getQSession().withPermissions("document.attach");
       QContext.getQSession().getPermissions().remove("document.write");
       assertThat(service.rename(alice.id(), "renamed.txt", "new description").fileName()).isEqualTo("renamed.txt");
       assertThat(service.describe(alice.id(), "").description()).isEmpty();