chore(deps): bump the metaobjects group with 6 updates

[dependabot]

Bumps the metaobjects group with 6 updates:

Package	From	To
@metaobjectsdev/cli	1.0.0	1.0.4
@metaobjectsdev/codegen-ts	1.0.0	1.0.4
@metaobjectsdev/render	1.0.0	1.0.4
@metaobjectsdev/runtime-ts	1.0.0	1.0.4
@metaobjectsdev/sdk	1.0.0	1.0.4
@metaobjectsdev/metadata	1.0.0	1.0.4

Updates @metaobjectsdev/cli from 1.0.0 to 1.0.4

Release notes

Sourced from @​metaobjectsdev/cli's releases.

1.0.4

All four registries publish: npm 1.0.4 (full lockstep across all 14 @metaobjectsdev/* publish candidates), Maven Central 8.0.4, PyPI 1.0.4, NuGet 1.0.4 — every port has changed product code. metamodelVersion stays 1.0.

Upgrading: run meta gen. Every generated file's header comment changed (#367), and generated routes files gain an auth-seam JSDoc block, so meta verify --codegen reports drift on any project that commits its generated output until it is regenerated. For most projects that regen diff is comments only — zero non-comment lines. Two shapes change for real: a model with two identity.reference nodes onto the same target gets corrected FK wiring and referential actions (#368 — including an ON DELETE / ON UPDATE diff on the next meta migrate), and an M:N relationship inherited through extends now derives navigation that was previously dropped from the output with no error.

Added

• Libraries: reusable declared design you opt into (FR-043, the sixth pillar). "libraries": ["iam"] in .metaobjects/config.json brings a shipped, requirement-backed model into your project. Two ship: iam (preview) — users, nestable typed groups, roles as permission bundles, grants global or scoped to a group, nine entities and eleven requirements — and ai (stable), the LLM-call trace envelope that already existed.

  A library is LAYERED, and the core layer is INERT. The core declares no source.rdb, and a sourceless object generates nothing and migrates to nothing (#248), so ["iam"] adds zero tables and zero generated code — the design is present and resolvable, and nothing else happens until you add ["iam", "iam/db"]. A layer token implies its core; a token whose layer is unknown is dropped whole rather than reduced to it, because answering a mistyped iam/database with an inert core and no tables is the worst of the available outcomes.

  Copy is the expected mode. meta eject <library> copies every layer into your first DECLARED source root with a provenance header, and meta eject --list reports how far your copy has drifted from the shipped tree — nodes changed, only-upstream, only-yours — matched by name with the package neutralized, because renaming the package is something you are invited to do. Ejecting and leaving the library in libraries is refused at load (ERR_LIBRARY_PACKAGE_COLLISION): both trees merge, and the merge is asymmetric — additions take effect, deletions do not. Its mirror ERR_LIBRARY_PACKAGE_NOT_OWNED refuses a NEW node declared into a library's package; an overlay: true amendment stays open. See libraries.md.

  meta gen --list carries kind: "library" rows beside the generators — one door, one namespace — with useWhen, layers, provides, and under --probe what your selection actually added here.

• overlay: true licenses an attribute override. ERR_MERGE_CONFLICT now fires only on an UNMARKED conflicting redeclaration. The flag is the author saying "I know about the other declaration and I mean to change it", and without this an adopter could not disagree with a library's shipped requirement without ejecting the whole ledger. All four loaders (Kotlin inherits the JVM's); one new conformance fixture takes over the unmarked-conflict

... (truncated)

Changelog

Sourced from @​metaobjectsdev/cli's changelog.

[1.0.4] — 2026-09-14

All four registries publish: npm 1.0.4 (full lockstep across all 14 @metaobjectsdev/* publish candidates), Maven Central 8.0.4, PyPI 1.0.4, NuGet 1.0.4 — every port has changed product code. metamodelVersion stays 1.0.

Upgrading: run meta gen. Every generated file's header comment changed (#367), and generated routes files gain an auth-seam JSDoc block, so meta verify --codegen reports drift on any project that commits its generated output until it is regenerated. For most projects that regen diff is comments only — zero non-comment lines. Two shapes change for real: a model with two identity.reference nodes onto the same target gets corrected FK wiring and referential actions (#368 — including an ON DELETE / ON UPDATE diff on the next meta migrate), and an M:N relationship inherited through extends now derives navigation that was previously dropped from the output with no error.

Added

• Libraries: reusable declared design you opt into (FR-043, the sixth pillar). "libraries": ["iam"] in .metaobjects/config.json brings a shipped, requirement-backed model into your project. Two ship: iam (preview) — users, nestable typed groups, roles as permission bundles, grants global or scoped to a group, nine entities and eleven requirements — and ai (stable), the LLM-call trace envelope that already existed.

  A library is LAYERED, and the core layer is INERT. The core declares no source.rdb, and a sourceless object generates nothing and migrates to nothing (#248), so ["iam"] adds zero tables and zero generated code — the design is present and resolvable, and nothing else happens until you add ["iam", "iam/db"]. A layer token implies its core; a token whose layer is unknown is dropped whole rather than reduced to it, because answering a mistyped iam/database with an inert core and no tables is the worst of the available outcomes.

  Copy is the expected mode. meta eject <library> copies every layer into your first DECLARED source root with a provenance header, and meta eject --list reports how far your copy has drifted from the shipped tree — nodes changed, only-upstream, only-yours — matched by name with the package neutralized, because renaming the package is something you are invited to do. Ejecting and leaving the library in libraries is refused at load (ERR_LIBRARY_PACKAGE_COLLISION): both trees merge, and the merge is asymmetric — additions take effect, deletions do not. Its mirror ERR_LIBRARY_PACKAGE_NOT_OWNED refuses a NEW node declared into a library's package; an overlay: true amendment stays open. See libraries.md.

  meta gen --list carries kind: "library" rows beside the generators — one door, one namespace — with useWhen, layers, provides, and under --probe what your selection actually added here.

• overlay: true licenses an attribute override. ERR_MERGE_CONFLICT now fires only on an UNMARKED conflicting redeclaration. The flag is the author saying "I know about the other declaration and I mean to change it", and without this an adopter could not disagree with a library's shipped requirement without ejecting the whole ledger. All four loaders (Kotlin inherits the JVM's); one new conformance fixture takes over the unmarked-conflict

... (truncated)

Commits

• 294f118 chore(release): @​metaobjectsdev TypeScript packages 1.0.4
• b1d9ca9 fix(gate): the subpath gate must compare against the DECLARED target, not jus...
• 8502803 fix(metadata): gate the subpath-resolution class, and close the one still open
• 099d2d8 test(cli): catalog-conformance asserted the duplicate-name refusal without ex...
• 3adfa2d test(cli): two source-text assertions become a parse and a consumer call
• bfe3b5b fix(library): eject staleness keys on the package-relative path, and three no...
• 700d2f0 feat(library): a generator keys on a declared ANCHOR, and an ejected copy is ...
• df64b35 feat(cli): a library is a catalog row — one table, one namespace, one --probe
• bc3eddf feat(verify): a library's ledger cannot volunteer you for coverage — and must...
• ee7cb13 feat(library): iam ships, libraries are LAYERED, and the selection is layer-g...
• Additional commits viewable in compare view

Updates @metaobjectsdev/codegen-ts from 1.0.0 to 1.0.4

Release notes

Sourced from @​metaobjectsdev/codegen-ts's releases.

1.0.4

All four registries publish: npm 1.0.4 (full lockstep across all 14 @metaobjectsdev/* publish candidates), Maven Central 8.0.4, PyPI 1.0.4, NuGet 1.0.4 — every port has changed product code. metamodelVersion stays 1.0.

Upgrading: run meta gen. Every generated file's header comment changed (#367), and generated routes files gain an auth-seam JSDoc block, so meta verify --codegen reports drift on any project that commits its generated output until it is regenerated. For most projects that regen diff is comments only — zero non-comment lines. Two shapes change for real: a model with two identity.reference nodes onto the same target gets corrected FK wiring and referential actions (#368 — including an ON DELETE / ON UPDATE diff on the next meta migrate), and an M:N relationship inherited through extends now derives navigation that was previously dropped from the output with no error.

Added

• Libraries: reusable declared design you opt into (FR-043, the sixth pillar). "libraries": ["iam"] in .metaobjects/config.json brings a shipped, requirement-backed model into your project. Two ship: iam (preview) — users, nestable typed groups, roles as permission bundles, grants global or scoped to a group, nine entities and eleven requirements — and ai (stable), the LLM-call trace envelope that already existed.

  A library is LAYERED, and the core layer is INERT. The core declares no source.rdb, and a sourceless object generates nothing and migrates to nothing (#248), so ["iam"] adds zero tables and zero generated code — the design is present and resolvable, and nothing else happens until you add ["iam", "iam/db"]. A layer token implies its core; a token whose layer is unknown is dropped whole rather than reduced to it, because answering a mistyped iam/database with an inert core and no tables is the worst of the available outcomes.

  Copy is the expected mode. meta eject <library> copies every layer into your first DECLARED source root with a provenance header, and meta eject --list reports how far your copy has drifted from the shipped tree — nodes changed, only-upstream, only-yours — matched by name with the package neutralized, because renaming the package is something you are invited to do. Ejecting and leaving the library in libraries is refused at load (ERR_LIBRARY_PACKAGE_COLLISION): both trees merge, and the merge is asymmetric — additions take effect, deletions do not. Its mirror ERR_LIBRARY_PACKAGE_NOT_OWNED refuses a NEW node declared into a library's package; an overlay: true amendment stays open. See libraries.md.

  meta gen --list carries kind: "library" rows beside the generators — one door, one namespace — with useWhen, layers, provides, and under --probe what your selection actually added here.

• overlay: true licenses an attribute override. ERR_MERGE_CONFLICT now fires only on an UNMARKED conflicting redeclaration. The flag is the author saying "I know about the other declaration and I mean to change it", and without this an adopter could not disagree with a library's shipped requirement without ejecting the whole ledger. All four loaders (Kotlin inherits the JVM's); one new conformance fixture takes over the unmarked-conflict

... (truncated)

Changelog

Sourced from @​metaobjectsdev/codegen-ts's changelog.

[1.0.4] — 2026-09-14

All four registries publish: npm 1.0.4 (full lockstep across all 14 @metaobjectsdev/* publish candidates), Maven Central 8.0.4, PyPI 1.0.4, NuGet 1.0.4 — every port has changed product code. metamodelVersion stays 1.0.

Upgrading: run meta gen. Every generated file's header comment changed (#367), and generated routes files gain an auth-seam JSDoc block, so meta verify --codegen reports drift on any project that commits its generated output until it is regenerated. For most projects that regen diff is comments only — zero non-comment lines. Two shapes change for real: a model with two identity.reference nodes onto the same target gets corrected FK wiring and referential actions (#368 — including an ON DELETE / ON UPDATE diff on the next meta migrate), and an M:N relationship inherited through extends now derives navigation that was previously dropped from the output with no error.

Added

• Libraries: reusable declared design you opt into (FR-043, the sixth pillar). "libraries": ["iam"] in .metaobjects/config.json brings a shipped, requirement-backed model into your project. Two ship: iam (preview) — users, nestable typed groups, roles as permission bundles, grants global or scoped to a group, nine entities and eleven requirements — and ai (stable), the LLM-call trace envelope that already existed.

  A library is LAYERED, and the core layer is INERT. The core declares no source.rdb, and a sourceless object generates nothing and migrates to nothing (#248), so ["iam"] adds zero tables and zero generated code — the design is present and resolvable, and nothing else happens until you add ["iam", "iam/db"]. A layer token implies its core; a token whose layer is unknown is dropped whole rather than reduced to it, because answering a mistyped iam/database with an inert core and no tables is the worst of the available outcomes.

  Copy is the expected mode. meta eject <library> copies every layer into your first DECLARED source root with a provenance header, and meta eject --list reports how far your copy has drifted from the shipped tree — nodes changed, only-upstream, only-yours — matched by name with the package neutralized, because renaming the package is something you are invited to do. Ejecting and leaving the library in libraries is refused at load (ERR_LIBRARY_PACKAGE_COLLISION): both trees merge, and the merge is asymmetric — additions take effect, deletions do not. Its mirror ERR_LIBRARY_PACKAGE_NOT_OWNED refuses a NEW node declared into a library's package; an overlay: true amendment stays open. See libraries.md.

  meta gen --list carries kind: "library" rows beside the generators — one door, one namespace — with useWhen, layers, provides, and under --probe what your selection actually added here.

• overlay: true licenses an attribute override. ERR_MERGE_CONFLICT now fires only on an UNMARKED conflicting redeclaration. The flag is the author saying "I know about the other declaration and I mean to change it", and without this an adopter could not disagree with a library's shipped requirement without ejecting the whole ledger. All four loaders (Kotlin inherits the JVM's); one new conformance fixture takes over the unmarked-conflict

... (truncated)

Commits

• 294f118 chore(release): @​metaobjectsdev TypeScript packages 1.0.4
• eaff41d Merge remote-tracking branch 'origin/main' into followup/m2m-selfjoin-declari...
• 61470b8 Merge pull request #371 from metaobjectsdev/fix/368-assoc-ref-disambiguation
• 923e252 fix(metadata-ts): M:N derivation must use the DECLARING entity, not the visit...
• 3937057 fix(codegen-ts): #368 — the origin.first refusal broke a legal mutual 1:1
• f78cc95 fix(codegen-ts): #368 round 2 fix-round-1 -- the join-hop message's @​cardinal...
• 0aa3cb9 fix(codegen-ts): #368 round 2 -- the join-hop ambiguity message recommended a...
• b1afdd9 fix(codegen-ts): stop discarding the @​via hop's own name before the #368 ambi...
• c09f4dc fix(metadata,codegen-ts,docs): enumerate references instead of taking the fir...
• 700d2f0 feat(library): a generator keys on a declared ANCHOR, and an ejected copy is ...
• Additional commits viewable in compare view

Updates @metaobjectsdev/render from 1.0.0 to 1.0.4

Release notes

Sourced from @​metaobjectsdev/render's releases.

1.0.4

All four registries publish: npm 1.0.4 (full lockstep across all 14 @metaobjectsdev/* publish candidates), Maven Central 8.0.4, PyPI 1.0.4, NuGet 1.0.4 — every port has changed product code. metamodelVersion stays 1.0.

Upgrading: run meta gen. Every generated file's header comment changed (#367), and generated routes files gain an auth-seam JSDoc block, so meta verify --codegen reports drift on any project that commits its generated output until it is regenerated. For most projects that regen diff is comments only — zero non-comment lines. Two shapes change for real: a model with two identity.reference nodes onto the same target gets corrected FK wiring and referential actions (#368 — including an ON DELETE / ON UPDATE diff on the next meta migrate), and an M:N relationship inherited through extends now derives navigation that was previously dropped from the output with no error.

Added

• Libraries: reusable declared design you opt into (FR-043, the sixth pillar). "libraries": ["iam"] in .metaobjects/config.json brings a shipped, requirement-backed model into your project. Two ship: iam (preview) — users, nestable typed groups, roles as permission bundles, grants global or scoped to a group, nine entities and eleven requirements — and ai (stable), the LLM-call trace envelope that already existed.

  A library is LAYERED, and the core layer is INERT. The core declares no source.rdb, and a sourceless object generates nothing and migrates to nothing (#248), so ["iam"] adds zero tables and zero generated code — the design is present and resolvable, and nothing else happens until you add ["iam", "iam/db"]. A layer token implies its core; a token whose layer is unknown is dropped whole rather than reduced to it, because answering a mistyped iam/database with an inert core and no tables is the worst of the available outcomes.

  Copy is the expected mode. meta eject <library> copies every layer into your first DECLARED source root with a provenance header, and meta eject --list reports how far your copy has drifted from the shipped tree — nodes changed, only-upstream, only-yours — matched by name with the package neutralized, because renaming the package is something you are invited to do. Ejecting and leaving the library in libraries is refused at load (ERR_LIBRARY_PACKAGE_COLLISION): both trees merge, and the merge is asymmetric — additions take effect, deletions do not. Its mirror ERR_LIBRARY_PACKAGE_NOT_OWNED refuses a NEW node declared into a library's package; an overlay: true amendment stays open. See libraries.md.

  meta gen --list carries kind: "library" rows beside the generators — one door, one namespace — with useWhen, layers, provides, and under --probe what your selection actually added here.

• overlay: true licenses an attribute override. ERR_MERGE_CONFLICT now fires only on an UNMARKED conflicting redeclaration. The flag is the author saying "I know about the other declaration and I mean to change it", and without this an adopter could not disagree with a library's shipped requirement without ejecting the whole ledger. All four loaders (Kotlin inherits the JVM's); one new conformance fixture takes over the unmarked-conflict

... (truncated)

Changelog

Sourced from @​metaobjectsdev/render's changelog.

[1.0.4] — 2026-09-14

All four registries publish: npm 1.0.4 (full lockstep across all 14 @metaobjectsdev/* publish candidates), Maven Central 8.0.4, PyPI 1.0.4, NuGet 1.0.4 — every port has changed product code. metamodelVersion stays 1.0.

Upgrading: run meta gen. Every generated file's header comment changed (#367), and generated routes files gain an auth-seam JSDoc block, so meta verify --codegen reports drift on any project that commits its generated output until it is regenerated. For most projects that regen diff is comments only — zero non-comment lines. Two shapes change for real: a model with two identity.reference nodes onto the same target gets corrected FK wiring and referential actions (#368 — including an ON DELETE / ON UPDATE diff on the next meta migrate), and an M:N relationship inherited through extends now derives navigation that was previously dropped from the output with no error.

Added

• Libraries: reusable declared design you opt into (FR-043, the sixth pillar). "libraries": ["iam"] in .metaobjects/config.json brings a shipped, requirement-backed model into your project. Two ship: iam (preview) — users, nestable typed groups, roles as permission bundles, grants global or scoped to a group, nine entities and eleven requirements — and ai (stable), the LLM-call trace envelope that already existed.

  A library is LAYERED, and the core layer is INERT. The core declares no source.rdb, and a sourceless object generates nothing and migrates to nothing (#248), so ["iam"] adds zero tables and zero generated code — the design is present and resolvable, and nothing else happens until you add ["iam", "iam/db"]. A layer token implies its core; a token whose layer is unknown is dropped whole rather than reduced to it, because answering a mistyped iam/database with an inert core and no tables is the worst of the available outcomes.

  Copy is the expected mode. meta eject <library> copies every layer into your first DECLARED source root with a provenance header, and meta eject --list reports how far your copy has drifted from the shipped tree — nodes changed, only-upstream, only-yours — matched by name with the package neutralized, because renaming the package is something you are invited to do. Ejecting and leaving the library in libraries is refused at load (ERR_LIBRARY_PACKAGE_COLLISION): both trees merge, and the merge is asymmetric — additions take effect, deletions do not. Its mirror ERR_LIBRARY_PACKAGE_NOT_OWNED refuses a NEW node declared into a library's package; an overlay: true amendment stays open. See libraries.md.

  meta gen --list carries kind: "library" rows beside the generators — one door, one namespace — with useWhen, layers, provides, and under --probe what your selection actually added here.

• overlay: true licenses an attribute override. ERR_MERGE_CONFLICT now fires only on an UNMARKED conflicting redeclaration. The flag is the author saying "I know about the other declaration and I mean to change it", and without this an adopter could not disagree with a library's shipped requirement without ejecting the whole ledger. All four loaders (Kotlin inherits the JVM's); one new conformance fixture takes over the unmarked-conflict

... (truncated)

Commits

• 294f118 chore(release): @​metaobjectsdev TypeScript packages 1.0.4
• cc4684a chore(release): @​metaobjectsdev TypeScript packages 1.0.3
• afa979b chore(release): @​metaobjectsdev TypeScript packages 1.0.2
• 3805608 chore(release): @​metaobjectsdev TypeScript packages 1.0.1
• See full diff in compare view

Updates @metaobjectsdev/runtime-ts from 1.0.0 to 1.0.4

Release notes

Sourced from @​metaobjectsdev/runtime-ts's releases.

1.0.4

All four registries publish: npm 1.0.4 (full lockstep across all 14 @metaobjectsdev/* publish candidates), Maven Central 8.0.4, PyPI 1.0.4, NuGet 1.0.4 — every port has changed product code. metamodelVersion stays 1.0.

Upgrading: run meta gen. Every generated file's header comment changed (#367), and generated routes files gain an auth-seam JSDoc block, so meta verify --codegen reports drift on any project that commits its generated output until it is regenerated. For most projects that regen diff is comments only — zero non-comment lines. Two shapes change for real: a model with two identity.reference nodes onto the same target gets corrected FK wiring and referential actions (#368 — including an ON DELETE / ON UPDATE diff on the next meta migrate), and an M:N relationship inherited through extends now derives navigation that was previously dropped from the output with no error.

Added

• Libraries: reusable declared design you opt into (FR-043, the sixth pillar). "libraries": ["iam"] in .metaobjects/config.json brings a shipped, requirement-backed model into your project. Two ship: iam (preview) — users, nestable typed groups, roles as permission bundles, grants global or scoped to a group, nine entities and eleven requirements — and ai (stable), the LLM-call trace envelope that already existed.

  A library is LAYERED, and the core layer is INERT. The core declares no source.rdb, and a sourceless object generates nothing and migrates to nothing (#248), so ["iam"] adds zero tables and zero generated code — the design is present and resolvable, and nothing else happens until you add ["iam", "iam/db"]. A layer token implies its core; a token whose layer is unknown is dropped whole rather than reduced to it, because answering a mistyped iam/database with an inert core and no tables is the worst of the available outcomes.

  Copy is the expected mode. meta eject <library> copies every layer into your first DECLARED source root with a provenance header, and meta eject --list reports how far your copy has drifted from the shipped tree — nodes changed, only-upstream, only-yours — matched by name with the package neutralized, because renaming the package is something you are invited to do. Ejecting and leaving the library in libraries is refused at load (ERR_LIBRARY_PACKAGE_COLLISION): both trees merge, and the merge is asymmetric — additions take effect, deletions do not. Its mirror ERR_LIBRARY_PACKAGE_NOT_OWNED refuses a NEW node declared into a library's package; an overlay: true amendment stays open. See libraries.md.

  meta gen --list carries kind: "library" rows beside the generators — one door, one namespace — with useWhen, layers, provides, and under --probe what your selection actually added here.

• overlay: true licenses an attribute override. ERR_MERGE_CONFLICT now fires only on an UNMARKED conflicting redeclaration. The flag is the author saying "I know about the other declaration and I mean to change it", and without this an adopter could not disagree with a library's shipped requirement without ejecting the whole ledger. All four loaders (Kotlin inherits the JVM's); one new conformance fixture takes over the unmarked-conflict

... (truncated)

Changelog

Sourced from @​metaobjectsdev/runtime-ts's changelog.

[1.0.4] — 2026-09-14

All four registries publish: npm 1.0.4 (full lockstep across all 14 @metaobjectsdev/* publish candidates), Maven Central 8.0.4, PyPI 1.0.4, NuGet 1.0.4 — every port has changed product code. metamodelVersion stays 1.0.

Upgrading: run meta gen. Every generated file's header comment changed (#367), and generated routes files gain an auth-seam JSDoc block, so meta verify --codegen reports drift on any project that commits its generated output until it is regenerated. For most projects that regen diff is comments only — zero non-comment lines. Two shapes change for real: a model with two identity.reference nodes onto the same target gets corrected FK wiring and referential actions (#368 — including an ON DELETE / ON UPDATE diff on the next meta migrate), and an M:N relationship inherited through extends now derives navigation that was previously dropped from the output with no error.

Added

• Libraries: reusable declared design you opt into (FR-043, the sixth pillar). "libraries": ["iam"] in .metaobjects/config.json brings a shipped, requirement-backed model into your project. Two ship: iam (preview) — users, nestable typed groups, roles as permission bundles, grants global or scoped to a group, nine entities and eleven requirements — and ai (stable), the LLM-call trace envelope that already existed.

  A library is LAYERED, and the core layer is INERT. The core declares no source.rdb, and a sourceless object generates nothing and migrates to nothing (#248), so ["iam"] adds zero tables and zero generated code — the design is present and resolvable, and nothing else happens until you add ["iam", "iam/db"]. A layer token implies its core; a token whose layer is unknown is dropped whole rather than reduced to it, because answering a mistyped iam/database with an inert core and no tables is the worst of the available outcomes.

  Copy is the expected mode. meta eject <library> copies every layer into your first DECLARED source root with a provenance header, and meta eject --list reports how far your copy has drifted from the shipped tree — nodes changed, only-upstream, only-yours — matched by name with the package neutralized, because renaming the package is something you are invited to do. Ejecting and leaving the library in libraries is refused at load (ERR_LIBRARY_PACKAGE_COLLISION): both trees merge, and the merge is asymmetric — additions take effect, deletions do not. Its mirror ERR_LIBRARY_PACKAGE_NOT_OWNED refuses a NEW node declared into a library's package; an overlay: true amendment stays open. See libraries.md.

  meta gen --list carries kind: "library" rows beside the generators — one door, one namespace — with useWhen, layers, provides, and under --probe what your selection actually added here.

• overlay: true licenses an attribute override. ERR_MERGE_CONFLICT now fires only on an UNMARKED conflicting redeclaration. The flag is the author saying "I know about the other declaration and I mean to change it", and without this an adopter could not disagree with a library's shipped requirement without ejecting the whole ledger. All four loaders (Kotlin inherits the JVM's); one new conformance fixture takes over the unmarked-conflict

... (truncated)

Commits

• 294f118 chore(release): @​metaobjectsdev TypeScript packages 1.0.4
• eaff41d Merge remote-tracking branch 'origin/main' into followup/m2m-selfjoin-declari...
• 61470b8 Merge pull request #371 from metaobjectsdev/fix/368-assoc-ref-disambiguation
• 923e252 fix(metadata-ts): M:N derivation must use the DECLARING entity, not the visit...
• 6b47b8d test(runtime-ts): #368 — pin @​sourceRefField at both relation-resolver call s...
• 6b3d2e4 fix(runtime-ts): relation traversal read the first FK for every relation (#368)
• ee7cb13 feat(library): iam ships, libraries are LAYERED, and the selection is layer-g...
• 29b328f fix(codegen): generated files stop pointing at a plugin point that does not e...
• cc4684a chore(release): @​metaobjectsdev TypeScript packages 1.0.3
• afa979b chore(release): @​metaobjectsdev TypeScript packages 1.0.2
• Additional commits viewable in compare view

Updates @metaobjectsdev/sdk from 1.0.0 to 1.0.4

Release notes

Sourced from @​metaobjectsdev/sdk's releases.

1.0.4

All four registries publish: npm 1.0.4 (full lockstep across all 14 @metaobjectsdev/* publish candidates), Maven Central 8.0.4, PyPI 1.0.4, NuGet 1.0.4 — every port has changed product code. metamodelVersion stays 1.0.

Upgrading: run meta gen. Every generated file's header comment changed (#367), and generated routes files gain an auth-seam JSDoc block, so meta verify --codegen reports drift on any project that commits its generated output until it is regenerated. For most projects that regen diff is comments only — zero non-comment lines. Two shapes change for real: a model with two identity.reference nodes onto the same target gets corrected FK wiring and referential actions (#368 — including an ON DELETE / ON UPDATE diff on the next meta migrate), and an M:N relationship inherited through extends now derives navigation that was previously dropped from the output with no error.

Added

• Libraries: reusable declared design you opt into (FR-043, the sixth pillar). "libraries": ["iam"] in .metaobjects/config.json brings a shipped, requirement-backed model into your project. Two ship: iam (preview) — users, nestable typed groups, roles as permission bundles, grants global or scoped to a group, nine entities and eleven requirements — and ai (stable), the LLM-call trace envelope that already existed.

  A library is LAYERED, and the core layer is INERT. The core declares no source.rdb, and a sourceless object generates nothing and migrates to nothing (#248), so ["iam"] adds zero tables and zero generated code — the design is present and resolvable, and nothing else happens until you add ["iam", "iam/db"]. A layer token implies its core; a token whose layer is unknown is dropped whole rather than reduced to it, because answering a mistyped iam/database with an inert core and no tables is the worst of the available outcomes.

  Copy is the expected mode. meta eject <library> copies every layer into your first DECLARED source root with a provenance header, and meta eject --list reports how far your copy has drifted from the shipped tree — nodes changed, only-upstream, only-yours — matched by name with the package neutralized, because renaming the package is something you are invited to do. Ejecting and leaving the library in libraries is refused at load (ERR_LIBRARY_PACKAGE_COLLISION): both trees merge, and the merge is asymmetric — additions take effect, deletions do not. Its mirror ERR_LIBRARY_PACKAGE_NOT_OWNED refuses a NEW node declared into a library's package; an overlay: true amendment stays open. See libraries.md.

  meta gen --list carries kind: "library" rows beside the generators — one door, one namespace — with useWhen, layers, provides, and under --probe what your selection actually added here.

• overlay: true licenses an attribute override. ERR_MERGE_CONFLICT now fires only on an UNMARKED conflicting redeclaration. The flag is the author saying "I know about the other declaration and I mean to change it", and without this an adopter could not disagree with a library's shipped requirement without ejecting the whole ledger. All four loaders (Kotlin inherits the JVM's); one new conformance fixture takes over the unmarked-conflict

... (truncated)

Changelog

Sourced from @​metaobjectsdev/sdk's changelog.

[1.0.4] — 2026-09-14

All four registries publish: npm 1.0.4 (full lockstep across all 14 @metaobjectsdev/* publish candidates), Maven Central 8.0.4, PyPI 1.0.4, NuGet 1.0.4 — every port has changed product code. metamodelVersion stays 1.0.

Upgrading: run meta gen. Every generated file's header comment changed (#367), and generated routes files gain an auth-seam JSDoc block, so meta verify --codegen reports drift on any project that commits its generated output until it is regenerated. For most projects that regen diff is comments only — zero non-comment lines. Two shapes change for real: a model with two identity.reference nodes onto the same target gets corrected FK wiring and referential actions (#368 — including an ON DELETE / ON UPDATE diff on the next meta migrate), and an M:N relationship inherited through extends now derives navigation that was previously dropped from the output with no error.

Added

• Libraries: reusable declared design you opt into (FR-043, the sixth pillar). "libraries": ["iam"] in .metaobjects/config.json brings a shipped, requirement-backed model into your project. Two ship: iam (preview) — users, nestable typed groups, roles as permission bundles, grants global or scoped to a group, nine entities and eleven requirements — and ai (stable), the LLM-call trace envelope that already existed.

  A library is LAYERED, and the core layer is INERT. The core declares no source.rdb, and a sourceless object generates nothing and migrates to nothing (#248), so ["iam"] adds zero tables and zero generated code — the design is present and resolvable, and nothing else happens until you add ["iam", "iam/db"]. A layer token implies its core; a token whose layer is unknown is dropped whole rather than reduced to it, because answering a mistyped iam/database with an inert core and no tables is the worst of the available outcomes.

  Copy is the expected mode. meta eject <library> copies every layer into your first DECLARED source root with a provenance header, and meta eject --list reports how far your copy has drifted from the shipped tree — nodes changed, only-upstream, only-yours — matched by name with the package neutralized, because renaming the package is something you are invited to do. Ejecting and leaving the library in libraries is refused at load (ERR_LIBRARY_PACKAGE_COLLISION): both trees merge, and the merge is asymmetric — additions take effect, deletions do not. Its mirror ERR_LIBRARY_PACKAGE_NOT_OWNED refuses a NEW node declared into a library's package; an overlay: true amendment stays open. See libraries.md.

  meta gen --list carries kind: "library" rows beside the generators — one door, one namespace — with useWhen, layers, provides, and under --probe what your selection actually added here.

• overlay: true licenses an attribute override. ERR_MERGE_CONFLICT now fires only on an UNMARKED conflicting redeclaration. The flag is the author saying "I know about the other declaration and I mean to change it", and without this an adopter could not disagree with a library's shipped requirement without ejecting the whole ledger. All four loaders (Kotlin inherits the JVM's); one new conformance fixture takes over the unmarked-conflict

... (truncated)

Commits

• 294f118 chore(release): @​metaobjectsdev TypeScript packages 1.0.4
• 700d2f0 feat(library): a generator keys on a declared ANCHOR, and an ejected copy is ...
• ee7cb13 feat(library): iam ships, libraries are LAYERED, and the selection is layer-g...
• cc4684a chore(release): @​metaobjectsdev TypeScript packages 1.0.3
• df12984 fix(sdk): DependencyManifest ends the barrel's two-Manifest collision; the re...
• 7e994d0 feat(sdk): resolveCollection loads dependency snapshots first and composes th...
• 516b9b5 test(deps): cover writeLock/readLock byte determinism and dependencySourceId
• 98dbb95 feat(deps): lock and manifest schemas with sha256 integrity (FR-023)
• 24b3fcb refactor(deps): retire mode, the local override and three superseded error ...
• 1918a02 feat(config): dependencies in .metaobjects/config.json — sdk schema and Pyt...
• Additional commits viewable in compare view

Updates @metaobjectsdev/metadata from 1.0.0 to 1.0.4

Release notes

Sourced from @​metaobjectsdev/metadata's releases.

1.0.4

All four registries publish: npm 1.0.4 (full lockstep across all 14 @metaobjectsdev/* publish candidates), Maven Central 8.0.4, PyPI 1.0.4, NuGet 1.0.4 — every port has changed product code. metamodelVersion stays 1.0.

Upgrading: run meta gen. Every generated file's header comment changed (#367), and generated routes files gain an auth-seam JSDoc block, so meta verify --codegen reports drift on any project that commits its generated output until it is regenerated. For most projects that regen diff is comments only — zero non-comment lines. Two shapes change for real: a model with two identity.reference nodes onto the same target gets corrected FK wiring and referential actions (#368 — including an ON DELETE / ON UPDATE diff on the next meta migrate), and an M:N relationship inherited through extends now derives navigation that was previously dropped from the output with no error.

Added

• Libraries: reusable declared design you opt into (FR-043, the sixth pillar). "libraries": ["iam"] in .metaobjects/config.json brings a shipped, requirement-backed model into your project. Two ship: iam (preview) — users, nestable typed groups, roles as permission bundles, grants global or scoped to a group, nine entities and eleven requirements — and ai (stable), the LLM-call trace envelope that already existed.

  A library is LAYERED, and the core layer is INERT. The core declares no source.rdb, and a sourceless object generates nothing and migrates to nothing (#248), so ["iam"] adds zero tables and zero generated code — the design is present and resolvable, and nothing else happens until you add ["iam", "iam/db"]. A layer token implies its core; a token whose layer is unknown is dropped whole rather than reduced to it, because answering a mistyped iam/database with an inert core and no tables is the worst of the available outcomes.

  Copy is the expected mode. meta eject <library> copies every layer into your first DECLARED source root with a provenance header, and meta eject --list reports how far your copy has drifted from the shipped tree — nodes changed, only-upstream, only-yours — matched by name with the package neutralized, because renaming the package is something you are invited to do. Ejecting and leaving the library in libraries is refused at load (ERR_LIBRARY_PACKAGE_COLLISION): both trees merge, and the merge is asymmetric — additions take effect, deletions do not. Its mirror ERR_LIBRARY_PACKAGE_NOT_OWNED refuses a NEW node declared into a library's package; an overlay: true amendment stays open. See libraries.md.

  meta gen --list carries kind: "library" rows beside the generators — one door, one namespace — with useWhen, layers, provides, and under --probe what your selection actually added here.

• overlay: true licenses an attribute override. ERR_MERGE_CONFLICT now fires only on an UNMARKED conflicting redeclarati...

  Description has been truncated