chore(release): 0.22.1 coordinated (npm/PyPI/NuGet 0.22.1 · Maven 7.22.1)

Completes 0.22.0's assigned-primary-key fix in the ports that shared its
semantic half: Python, Java and Kotlin. An entity whose primary key carries no
`identity.primary @generation` had its create shape read the key's optionality
off `@required`, so a create body carrying no primary key at all was accepted
and could only fail at the database.

npm and NuGet publish as VERSION-PARITY bumps: TypeScript shipped the fix in
0.22.0, C# never had the defect (its DTO predicate already treats any PK field
as required), and both ports' only changed files are test/private-package
sources that never reach a registry.

Also lands the corpus that can see it. fixtures/validation-conformance gains a
second entity `Ledger` with an ASSIGNED key plus assigned-pk-present /
assigned-pk-missing, and an optional per-case `entity` key (absent means
`Account`) that all five runners dispatch on. The corpus was structurally blind:
`Account`'s key is @generation:increment, which every port drops from the create
shape entirely, and every model in this repo generates its primary keys.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: dmealing

CLAUDE.md

@@ -19,7 +19,9 @@ Equal weight — all four ship per-language today across the five ports (TS / C#
 
 _Last refreshed 2026-08-10._
 
-**TypeScript reference implementation** is **published to npm at `0.22.0`** (14 `@metaobjectsdev/*` publish candidates on the `latest` tag, full lockstep; the two `angular` packages are versioned on their own `0.6.x` line and are **NOT published to npm — source-only by decision** (ADR-0048): they build in-repo, and stay off the registry until they meet the ADR's promotion bar). C# at `0.22.0` (NuGet); Python at `0.22.0` (PyPI); Java / Kotlin at `7.22.0` (Maven Central). **All four registries share the same `minor.patch`, and stay locked in lockstep going forward** — the `0.20.15` cut moved Maven `7.20.12`→`7.20.15` to close the last per-registry drift.
+**TypeScript reference implementation** is **published to npm at `0.22.1`** (14 `@metaobjectsdev/*` publish candidates on the `latest` tag, full lockstep; the two `angular` packages are versioned on their own `0.6.x` line and are **NOT published to npm — source-only by decision** (ADR-0048): they build in-repo, and stay off the registry until they meet the ADR's promotion bar). C# at `0.22.1` (NuGet); Python at `0.22.1` (PyPI); Java / Kotlin at `7.22.1` (Maven Central). **All four registries share the same `minor.patch`, and stay locked in lockstep going forward** — the `0.20.15` cut moved Maven `7.20.12`→`7.20.15` to close the last per-registry drift.
+
+**The `0.22.1` line is a coordinated PATCH across all four registries** (npm `0.22.1` · PyPI `0.22.1` · NuGet `0.22.1` · Maven `7.22.1`) completing 0.22.0's assigned-primary-key fix in the ports that shared its semantic half. **npm and NuGet are version-parity bumps** — TS shipped the fix in 0.22.0 and C# never had the defect. An entity whose PK carries no `identity.primary @generation` — a natural key, or an id issued upstream — had its create shape read the key's optionality off `@required` like any other field, so a key not marked `@required` was **optional in the generated create/validation artifact** and a create body carrying no primary key at all was accepted, to fail at the database. Now required (with no `@default`) in Python's `<Entity>Create`, Java's `<Entity>Dto` (`@NotNull`) and Kotlin's data class (a non-null property, so the body cannot bind); an `increment`/`uuid` key still stays optional-or-omitted and a `@default`-bearing key stays optional. **C# was already correct** (`CSharpNaming.IsRequired` treats any PK field as required) — it was initially mis-reported as affected by reading `RequiredCreateKeys` in the ROUTES generator, which is the raw-JSON presence check, a different tier with a different answer; the corpus settled it. **The durable lesson is the corpus's blindness, not the bug:** `validation-conformance`'s `Account` has a `@generation: increment` key that every port drops from the create shape entirely, so no existing case could express the opposite — and more generally **every model in this repo generates its primary keys**, which is why a defect in four of five ports survived every gate until the 0.22.0 external smoke test authored a model the repo does not contain. A second entity `Ledger` (assigned **string** key — a value-typed key cannot express "absent" vs "default" in a DataAnnotations-style artifact, so that case belongs to `api-contract-conformance`) plus an optional per-case `entity` key now gates it in all five runners. See `CHANGELOG.md` [0.22.1].
 
 **The `0.22.0` line is a coordinated MINOR across all four registries** (npm `0.22.0` · PyPI `0.22.0` · NuGet `0.22.0` · Maven `7.22.0`) — **a new registered type family plus a registry tightening**, cut as MINOR because pre-1.0 `^0.21.x` resolves `<0.22.0`, so a consumer adopts it deliberately. (1) **Capability requirements are metadata**: `requirement.functional` / `requirement.architectural` are registered vocabulary in all five ports, declared in `metaobjects/` beside the entities they describe and loaded by the same loader — no side file, no bespoke parser. The two kinds carry **opposite checks** (`functional` fails when NOTHING implements it — existence; `architectural` fails when something VIOLATES it — universality, hence no level: a policy is object-independent by definition). **Hierarchy is nesting**, not a `parent` string, so regrouping moves a subtree and a requirement is addressable by the same dotted child-name path as every other node. Five levels with the `@implementedBy` link floor at **L4** (`ERR_REQUIREMENT_LINK_ABOVE_FLOOR`); `@status` is a closed enum the **LOADER** enforces (`live | partial | abandoned | superseded`) so a typo fails the load in every language rather than passing silently in four of them. `meta verify` owns what the loader cannot: **a dangling `@implementedBy` is an ERROR on `live`/`partial` and CORRECT on `abandoned`/`superseded`** — that asymmetry is the mechanism's whole point (those nodes are *supposed* to be gone; "fixing" it by deleting the entry destroys the record). `@verifiedBy` checks each named test exists and is not skipped, never runs them, and fails OPEN when no test files are visible. Object coverage ships as a **WARNING** deliberately — on a real 120-file repo carrying one requirement it reports 93 unclaimed entities, so promoting it to error would fail a project's first `verify` after authoring a single entry. Entirely opt-in: no `requirement.*` nodes ⇒ no diagnostics, and no codegen/migrate/runtime path reads the type. Adopter view: [`docs/features/requirements.md`](docs/features/requirements.md). (2) **`template.*` owns its attributes** (all five ports) — FR-033 had re-homed them, **including required `@payloadRef`/`@toolName`**, into the composable `metaobjects-prompt` concern provider, so composing without it left `template.prompt` registered with ZERO attributes and `ERR_MISSING_REQUIRED_ATTR` simply stopped firing: invalid metadata began loading clean. → **ADR-0050** (own vs projected attributes: OWN attrs travel with the type, PROJECTED attrs are another concern applied to someone else's complete type and must be optional). (3) **`ERR_EXTEND_REQUIRED_ATTR`** — projecting a REQUIRED attr onto a type another provider owns now throws in every registry, across **two** doors (`extend` and `registerCommonAttrs`); **potentially breaking for a downstream provider** (a sweep of all 54 spec files here found zero). (4) **12 more Java types reject undeclared attributes** (`object.*`, `source.*`, all three `identity.*`, `relationship.*`, `validator.*`, `layout.*`, `origin.*`, `index.lookup`) → **ADR-0051** (extension IS registration; ADR-0011 and ADR-0023 were never in conflict — a wildcard is worse than a permissive extension point because it also swallows a **typo'd core attribute**, silently, on one port only). `template.*`'s Java wildcard is the one deliberately RETAINED: removing it trips `ERR_BAD_ATTR_VALUE` on `abstract: true`, because Java models `isAbstract` as an ATTR while TS models it as a NATIVE FIELD — closing it needs `isAbstract` homed consistently, a metamodel decision. Two defects were caught by the release's own external smoke test and fixed before publish: an **assigned primary key** (no `identity.primary @generation`) emitted an InsertSchema marking the PK `.optional()` while its Drizzle column `text("id").primaryKey()` has no default and is insert-required, so generated code **did not compile** (TS2769) — now gated by a test compiling the entity AND queries files together, since the defect lived *between* them; and `cli` carried a **dead `yaml` runtime dependency** orphaned when the ledger became registered vocabulary. See `CHANGELOG.md` [0.22.0].
 

README.md

@@ -93,7 +93,7 @@ first-week wedge plan — and `meta init` picks up from there.
 
 | Language | Status | Quickstart | Source |
 |---|---|---|---|
-| TypeScript | Published to npm at `0.22.0` (the `@metaobjectsdev/*` packages) | [`docs/ports/typescript.md`](docs/ports/typescript.md) | [`server/typescript/`](server/typescript/) · [`client/web/`](client/web/) |
+| TypeScript | Published to npm at `0.22.1` (the `@metaobjectsdev/*` packages) | [`docs/ports/typescript.md`](docs/ports/typescript.md) | [`server/typescript/`](server/typescript/) · [`client/web/`](client/web/) |
 | Java | Loader + OMDB + render + Maven plugin all shipped; full conformance green | [`docs/ports/java.md`](docs/ports/java.md) | [`server/java/`](server/java/) |
 | Kotlin | Codegen tier on top of Java — 14 generators (entity, Exposed table, relations, repository, payload, output-parser, output-prompt, render-helper, extractor, filter-allowlist, validator, Spring config, storedProc, Spring controller); 24 / 24 persistence-conformance | [`docs/ports/kotlin.md`](docs/ports/kotlin.md) | [`server/java/codegen-kotlin/`](server/java/codegen-kotlin/) · [`server/java/metadata-ktx/`](server/java/metadata-ktx/) |
 | C# | Loader + conformance + EF Core codegen + render engine + `dotnet meta` CLI all shipped | [`docs/ports/csharp.md`](docs/ports/csharp.md) | [`server/csharp/`](server/csharp/) |