james.maesandClaude Sonnet 5.5
0df2fc81e4
Align every module to QQQ Core 4.1.0-RC.22 and replace the paused-checkpoint status text with the current 1.0 status and operating limits. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Scripting middleware
Optional native QQQ UI API extension. The base QBit depends only on core; this artifact supplies authenticated transport and generated OpenAPI, without another source registry or runtime.
GAV: com.kingsrook.qbits:qbit-scripting-middleware:0.1.0-SNAPSHOT.
After producing the base QBit, the host calls ScriptingApi.register(qInstance) before middleware startup. The native /version discovery response advertises extension scripting version 1.0.0.
All routes are relative to the host's standard UI API prefix:
| Method | Path | Purpose |
|---|---|---|
| POST | /qbit/scripting/projects |
Create a server-marked isolated project; body contains name only |
| GET | /qbit/scripting/projects/{scriptId} |
Authorized project, recent revisions/builds/publications, available actions |
| GET | /qbit/scripting/projects/{scriptId}/revisions/{revisionId} |
Immutable source files |
| POST | /qbit/scripting/projects/{scriptId}/drafts |
Append draft using expected baseRevisionId |
| POST | /qbit/scripting/projects/{scriptId}/imports |
Explicit exact-commit import through the configured host provider |
| POST | /qbit/scripting/projects/{scriptId}/builds |
Compile saved revision and declared capabilities |
| GET | /qbit/scripting/projects/{scriptId}/builds/{buildId} |
Bounded compiler diagnostics |
| POST | /qbit/scripting/projects/{scriptId}/builds/{buildId}/test-context |
Test compiled artifact with bounded JSON context |
| POST | /qbit/scripting/projects/{scriptId}/builds/{buildId}/publications |
Publish tested immutable artifact |
| POST | /qbit/scripting/projects/{scriptId}/typings |
Permission-filtered editor declarations |
| GET | /qbit/scripting/projects/{scriptId}/hooks |
Authorized host phases and project binding page; optional beforeBindingId cursor |
| POST | /qbit/scripting/projects/{scriptId}/bindings |
Create an enabled binding pinned to a publication |
| POST | /qbit/scripting/projects/{scriptId}/bindings/{bindingId}/state |
Explicit boolean enable/disable |
| POST | /qbit/scripting/projects/{scriptId}/builds/{buildId}/test-hook |
Read-only selected-record event simulation |
Current authenticated QQQ session supplies identity; clients cannot supply actors, providers, commands or runtime configuration. Every action rechecks project association and its service permission. Source intake rejects legacy projects and requires the coordinated core isolation guard. This artifact selectively pins reviewed core/RDBMS 4.1.0-isolated-record-files-SNAPSHOT while other QQQ modules remain RC20. Creation and publication use typed core authority; no reflective class-presence gate remains. This local artifact is not a remote release.
Request limit is 3 MiB before JSON decoding, in addition to source, capability, context and worker bounds enforced by the service. Host ingress/Javalin limits should be configured consistently and remain bounded. Source/build/publication histories expose the latest 100 entries each; hook bindings use bounded keyset pages across all project publications, without bundles, signing keys, signatures or provider settings. Responses use the normal QQQ error envelope; unexpected exceptions return generic text. A timeout does not cancel or undo committed work. Refresh history before deciding whether to retry.
The generated fragment is src/main/resources/openapi/qqq-v1/scripting.yaml. From the base QBit directory:
.\mvnw.cmd -B -ntp install
.\mvnw.cmd -B -ntp -f middleware/pom.xml verify
# Intentional schema changes only:
.\mvnw.cmd -B -ntp -f middleware/pom.xml '-Dscripting.openapi.update=true' test
Verification: seven tests, including six actual Javalin HTTP tests for create/save/build/test/publish, hook binding controls, current session/association/legacy denials, injected context rejection, generic source-count refusal, worker failure-detail suppression and committed schema comparison for fourteen routes; full wrapper install passes. No sandbox, production database, deployment or full language-service IDE qualification is implied. The optional GitHub adapter is independently tested with trusted response fixtures.
Hook test bodies contain tableName, event, string recordId and scalar changes only. The server loads prior/current values, validates current permissions and never performs record writes. Binding mutation receipts share the mutation transaction. Worker execution audit commits independently and does not prove business-record commit. Failure responses expose host-owned outcome text, never untrusted worker error details.