metaobjects 0.19.3__tar.gz → 0.19.5__tar.gz

{metaobjects-0.19.3 → metaobjects-0.19.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metaobjects
-Version: 0.19.3
+Version: 0.19.5
 Summary: Cross-language metadata standard: declare typed entities once, generate idiomatic drift-checked code across languages — Python port.
 Project-URL: Homepage, https://metaobjects.dev
 Project-URL: Repository, https://github.com/metaobjectsdev/metaobjects
@@ -45,11 +45,13 @@ other language port.
 
 ## Install
 
+Requires **Python 3.11+**.
+
 ```bash
 pip install metaobjects
 ```
 
-Requires Python 3.11+. The only runtime dependency is PyYAML.
+The only runtime dependency is PyYAML.
 
 ## Quick start
 
@@ -77,7 +79,9 @@ The primary public API is the **loader** (`load_directory` / `load_uris` /
 `load_string`, `MetaDataLoader`, `LoadResult`, `ErrorCode`, `MetaError`). The
 distribution also ships the Python implementations of the other pillars used by the CLI
 and tooling: `codegen` (Pydantic + FastAPI emit), `render` (Mustache + payload-VO +
-verify), `runtime` (SQLAlchemy-Core object manager), and `migrate`.
+verify), and `runtime` (a DB-API 2 `ObjectManager` — pg8000 / psycopg — no SQLAlchemy).
+Schema migrations are owned by the TypeScript `meta` CLI (ADR-0015); there is
+**no `migrate` module** in this distribution.
 
 ## Authoring formats
 

{metaobjects-0.19.3 → metaobjects-0.19.5}/README.md

@@ -10,11 +10,13 @@ other language port.
 
 ## Install
 
+Requires **Python 3.11+**.
+
 ```bash
 pip install metaobjects
 ```
 
-Requires Python 3.11+. The only runtime dependency is PyYAML.
+The only runtime dependency is PyYAML.
 
 ## Quick start
 
@@ -42,7 +44,9 @@ The primary public API is the **loader** (`load_directory` / `load_uris` /
 `load_string`, `MetaDataLoader`, `LoadResult`, `ErrorCode`, `MetaError`). The
 distribution also ships the Python implementations of the other pillars used by the CLI
 and tooling: `codegen` (Pydantic + FastAPI emit), `render` (Mustache + payload-VO +
-verify), `runtime` (SQLAlchemy-Core object manager), and `migrate`.
+verify), and `runtime` (a DB-API 2 `ObjectManager` — pg8000 / psycopg — no SQLAlchemy).
+Schema migrations are owned by the TypeScript `meta` CLI (ADR-0015); there is
+**no `migrate` module** in this distribution.
 
 ## Authoring formats
 

{metaobjects-0.19.3 → metaobjects-0.19.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "metaobjects"
-version = "0.19.3"
+version = "0.19.5"
 description = "Cross-language metadata standard: declare typed entities once, generate idiomatic drift-checked code across languages — Python port."
 readme = "README.md"
 requires-python = ">=3.11"

{metaobjects-0.19.3 → metaobjects-0.19.5}/src/metaobjects/cli.py

@@ -573,6 +573,16 @@ _TEMPLATE_TEXT_REF_ATTRS = (
 )
 
 
+def _attr_str_list(raw: object) -> list[str] | None:
+    """Coerce a string-array attr (a list, or a single string) to ``list[str]``; ``None``
+    when absent — the shape :func:`render.verify` expects for required_slots/required_tags."""
+    if isinstance(raw, str):
+        return [raw]
+    if isinstance(raw, (list, tuple)):
+        return [str(x) for x in raw]
+    return None
+
+
 def _verify_templates(args: argparse.Namespace) -> int:
     """``verify --templates`` — the template/prompt ``{{field}}`` ↔ payload drift gate.
 
@@ -659,6 +669,16 @@ def _verify_templates(args: argparse.Namespace) -> int:
             error_count += 1
             continue
 
+        # #193/#230: @requiredSlots/@requiredTags are a template.prompt concept — enforced ONLY on
+        # the prompt path (the email/document output gate does not apply them per-part; the #193
+        # cross-port consensus). A prompt whose body omits a required output tag →
+        # ERR_OUTPUT_TAG_MISSING (drift, fails); an unused required slot → ERR_REQUIRED_SLOT_UNUSED
+        # (warning). This brings Python to parity with TS/Java/C# (previously it enforced neither).
+        is_prompt = tmpl.sub_type == tc.TEMPLATE_SUBTYPE_PROMPT
+        # ADR-0039: resolving read — an inherited @requiredSlots/@requiredTags is honored.
+        req_slots = _attr_str_list(tmpl.get_meta_attr(tc.TEMPLATE_ATTR_REQUIRED_SLOTS)) if is_prompt else None
+        req_tags = _attr_str_list(tmpl.get_meta_attr(tc.TEMPLATE_ATTR_REQUIRED_TAGS)) if is_prompt else None
+
         for ref in refs:
             text = provider.resolve(ref)
             if text is None:
@@ -670,12 +690,14 @@ def _verify_templates(args: argparse.Namespace) -> int:
                 error_count += 1
                 continue
             checked += 1
-            for e in render_verify(text, fields, provider=provider):
+            for e in render_verify(
+                text, fields, provider=provider,
+                required_slots=req_slots, required_tags=req_tags,
+            ):
                 if e.code == ERR_REQUIRED_SLOT_UNUSED:
-                    continue  # warning, not drift
+                    continue  # an unused required slot is a warning, not drift
                 print(
-                    f"error: [{tmpl.name}] ref '{ref}' — {e.code}: "
-                    f"{{{{{e.path}}}}} not on payload VO '{payload_ref}'.",
+                    f"error: [{tmpl.name}] ref '{ref}' — {e.code}: {e.path}",
                     file=sys.stderr,
                 )
                 error_count += 1

{metaobjects-0.19.3 → metaobjects-0.19.5}/src/metaobjects/codegen/generators/router_generator.py

@@ -52,6 +52,7 @@ from metaobjects.codegen.instance_artifacts import emits_instance_artifacts
 from metaobjects.codegen.type_map import PyType, py_type_for
 from metaobjects.meta.core.field import field_constants as fc
 from metaobjects.meta.core.field.meta_field import MetaField
+from metaobjects.meta.persistence.db import db_constants as dbc
 from metaobjects.meta.core.identity.identity_constants import (
     IDENTITY_ATTR_FIELDS,
     IDENTITY_REFERENCE_ATTR_REFERENCES,
@@ -95,7 +96,73 @@ def _required_field_names(entity: MetaObject) -> list[str]:
     _scalar_fields, which drops object fields for the sort allowlist). FR-035
     PATCH-2 guards present-null on any of these, and a @required jsonb column can
     be nulled just like a scalar one."""
-    return [f.name for f in entity.fields() if is_required(f)]
+    # #203/ADR-0045: an @autoSet field is server-owned — never a caller-facing PATCH field, so
+    # it is not present-null-checked (a caller-sent null is ignored/stamped, not a 400). Mirrors
+    # the Kotlin controller (which excludes @autoSet from its patch-settable set).
+    return [f.name for f in entity.fields() if is_required(f) and not _is_auto_set(f)]
+
+
+# --- #203 / ADR-0045: @autoSet stamping in the generated router (above the repo seam) ----------
+
+_AUTO_SET_TEMPORAL_SUBTYPES = (
+    fc.FIELD_SUBTYPE_DATE,
+    fc.FIELD_SUBTYPE_TIME,
+    fc.FIELD_SUBTYPE_TIMESTAMP,
+)
+
+
+def _is_auto_set(field: MetaField) -> bool:
+    """True iff *field* is a server-owned ``@autoSet`` column (ADR-0039 resolving read)."""
+    return field.get_meta_attr(fc.FIELD_ATTR_AUTO_SET) in (
+        fc.AUTO_SET_ON_CREATE,
+        fc.AUTO_SET_ON_UPDATE,
+    )
+
+
+def _auto_set_split(entity: MetaObject) -> tuple[list[MetaField], list[MetaField]]:
+    """The entity's ``@autoSet`` temporal fields split into ``(onCreate, onUpdate)``.
+
+    Reads the RESOLVING ``@autoSet`` (ADR-0039) so an inherited
+    ``BaseEntity.createdAt/updatedAt`` is honored; a non-temporal field is skipped.
+    Both lists are empty for an entity that declares none, keeping its router
+    byte-identical to the pre-#203 output."""
+    on_create: list[MetaField] = []
+    on_update: list[MetaField] = []
+    for f in entity.fields():
+        if f.sub_type not in _AUTO_SET_TEMPORAL_SUBTYPES:
+            continue
+        mode = f.get_meta_attr(fc.FIELD_ATTR_AUTO_SET)  # ADR-0039 resolving: may be inherited via extends
+        if mode == fc.AUTO_SET_ON_CREATE:
+            on_create.append(f)
+        elif mode == fc.AUTO_SET_ON_UPDATE:
+            on_update.append(f)
+    return on_create, on_update
+
+
+def _auto_set_stamp_expr(field: MetaField, base_var: str) -> str:
+    """The inline now()-expression for an ``@autoSet`` *field*, derived from one shared
+    tz-aware *base_var* datetime so every column stamped in one op is equal (a fresh
+    row's created == updated). Keyed off the COLUMN's temporal type: ``field.date`` →
+    ``.date()``; ``field.time`` → ``.time()``; ``field.timestamp`` → the tz-aware base
+    (``@localTime`` → a naive wall-clock value). Mirrors ObjectManager._auto_set_stamp."""
+    sub = field.sub_type
+    if sub == fc.FIELD_SUBTYPE_DATE:
+        return f"{base_var}.date()"
+    if sub == fc.FIELD_SUBTYPE_TIME:
+        return f"{base_var}.time()"
+    is_tz = field.get_meta_attr(dbc.FIELD_ATTR_LOCAL_TIME) is not True  # ADR-0039 resolving
+    return base_var if is_tz else f"{base_var}.replace(tzinfo=None)"
+
+
+def _auto_set_stamp_lines(fields: list[MetaField], comment: str) -> list[str]:
+    """Router-handler body lines stamping *fields* into ``dto`` from ONE captured base
+    instant (so all same-op columns are equal), led by *comment*. Empty for no fields
+    (so the call site spreads to nothing — a non-@autoSet router stays byte-identical)."""
+    if not fields:
+        return []
+    lines = [f"    # {comment}", "    _asnow = _dt.datetime.now(_dt.timezone.utc)"]
+    lines += [f'    dto["{f.name}"] = {_auto_set_stamp_expr(f, "_asnow")}' for f in fields]
+    return lines
 
 
 def _py_set_literal(names: list[str], *, frozen: bool = False) -> str:
@@ -259,6 +326,8 @@ class RouterGenerator:
         ops_const: str,
         model_name: str,
         patch_model: str,
+        create_autoset: list[str] = (),
+        update_autoset: list[str] = (),
     ) -> list[str]:
         """One CRUD route handler block, dispatched by *name*
         (``list`` / ``get`` / ``create`` / ``update`` / ``delete``). Override to
@@ -318,6 +387,10 @@ class RouterGenerator:
                 f"        {model_name}(**dto)",
                 "    except ValidationError:",
                 '        return JSONResponse(status_code=400, content={"error": "validation"})',
+                # #203/ADR-0045: the generated router (the API surface) stamps @autoSet columns
+                # ABOVE the consumer repo seam — onCreate + onUpdate both stamped from one instant
+                # (a fresh row's createdAt == updatedAt), ignoring any caller-supplied value.
+                *create_autoset,
                 "    return repo.create(dto)",
             ]
         if name == "update":
@@ -341,6 +414,10 @@ class RouterGenerator:
                 f"        {patch_model}(**dto)",
                 "    except ValidationError:",
                 '        return JSONResponse(status_code=400, content={"error": "validation"})',
+                # #203/ADR-0045: bump onUpdate @autoSet columns (server-owned) on EVERY patch,
+                # above the repo seam — a server-inserted present key (compatible with the PATCH
+                # present-key tristate); onCreate columns are never touched here.
+                *update_autoset,
                 f"    saved = repo.update({pk_param}, dto)",
                 "    if saved is None:",
                 '        return JSONResponse(status_code=404, content={"error": "not_found"})',
@@ -417,6 +494,24 @@ class RouterGenerator:
         ops_const = f"{upper}_FILTER_OPS_BY_FIELD"
         allowlist_module = f"{snake}_filter_allowlist"
 
+        # #203/ADR-0045: @autoSet columns live on the BASE entity and are shared by every
+        # subtype (RESOLVING _auto_set_split(entity) picks up an inherited BaseEntity
+        # column too) — computed once here and threaded into each per-subtype handler
+        # below (empty for a non-@autoSet hierarchy → byte-identical output).
+        on_create_auto, on_update_auto = _auto_set_split(entity)
+        has_autoset = bool(on_create_auto or on_update_auto)
+        create_autoset = _auto_set_stamp_lines(
+            on_create_auto + on_update_auto,
+            "#203/ADR-0045: stamp @autoSet columns (server-owned; caller ignored).",
+        )
+        update_autoset = [
+            f'    dto.pop("{f.name}", None)  # onCreate @autoSet is write-once (server-owned)'
+            for f in on_create_auto
+        ] + _auto_set_stamp_lines(
+            on_update_auto,
+            "#203/ADR-0045: bump onUpdate @autoSet column(s) (server-owned).",
+        )
+
         # Sort allowlist = base scalar fields ∪ every subtype's own scalar fields, so a
         # per-subtype list can sort on a subtype-only column too. Stable order.
         sort_fields: list[str] = [f.name for f in _scalar_fields(entity)]
@@ -448,6 +543,10 @@ class RouterGenerator:
         )
         parts.append("from __future__ import annotations")
         parts.append("")
+        if has_autoset:
+            # #203/ADR-0045: the router stamps @autoSet columns inline (no runtime dependency).
+            parts.append("import datetime as _dt")
+            parts.append("")
         for import_line in sorted(pk.imports):
             parts.append(import_line)
         if pk.imports:
@@ -555,6 +654,9 @@ class RouterGenerator:
             parts.append(f"        {sub}Create(**dto)")
             parts.append("    except ValidationError:")
             parts.append('        return JSONResponse(status_code=400, content={"error": "validation"})')
+            # #203/ADR-0045: stamp @autoSet columns ABOVE the repo seam (empty for a
+            # non-@autoSet hierarchy — byte-identical output).
+            parts.extend(create_autoset)
             parts.append(f'    return repo.create("{val}", dto)')
             parts.append("")
             parts.append("")
@@ -585,6 +687,9 @@ class RouterGenerator:
             parts.append(f"        {sub}Patch(**dto)")
             parts.append("    except ValidationError:")
             parts.append('        return JSONResponse(status_code=400, content={"error": "validation"})')
+            # #203/ADR-0045: pop the write-once onCreate column(s), bump onUpdate — ABOVE
+            # the repo seam (empty for a non-@autoSet hierarchy — byte-identical output).
+            parts.extend(update_autoset)
             parts.append(f'    saved = repo.update("{val}", {pk_param}, dto)')
             parts.append("    if saved is None:")
             parts.append('        return JSONResponse(status_code=404, content={"error": "not_found"})')
@@ -684,6 +789,27 @@ class RouterGenerator:
         # is a 400 — the update handler guards these before the repo call.
         required_set_body = _py_set_literal(_required_field_names(entity), frozen=True)
 
+        # #203/ADR-0045: @autoSet stamp lines for the create/update handlers (empty for a
+        # non-@autoSet entity → byte-identical output). insert stamps onCreate+onUpdate from one
+        # instant; a patch bumps onUpdate only (createdAt stays immutable).
+        _on_create_auto, _on_update_auto = _auto_set_split(entity)
+        create_autoset = _auto_set_stamp_lines(
+            _on_create_auto + _on_update_auto,
+            "#203/ADR-0045: stamp @autoSet columns (server-owned; caller ignored).",
+        )
+        # #203/ADR-0045 (integrity): onCreate @autoSet columns are write-once — strip any
+        # caller-supplied value on PATCH before the repo call (a caller cannot mutate createdAt via
+        # the deployed API). Mirrors ObjectManager.update (`data.pop(...)`) + the Kotlin controller
+        # (which excludes @autoSet from its patch-settable set).
+        update_autoset = [
+            f'    dto.pop("{f.name}", None)  # onCreate @autoSet is write-once (server-owned)'
+            for f in _on_create_auto
+        ] + _auto_set_stamp_lines(
+            _on_update_auto,
+            "#203/ADR-0045: bump onUpdate @autoSet column(s) (server-owned).",
+        )
+        has_autoset = bool(_on_create_auto or _on_update_auto)
+
         parts: list[str] = []
         parts.append(
             generated_header(short_name, _effective_fqn(entity)).rstrip() + "\n"
@@ -691,6 +817,10 @@ class RouterGenerator:
         )
         parts.append("from __future__ import annotations")
         parts.append("")
+        if has_autoset:
+            # #203/ADR-0045: the router stamps @autoSet columns inline (no runtime dependency).
+            parts.append("import datetime as _dt")
+            parts.append("")
         for import_line in sorted(pk.imports):
             parts.append(import_line)
         if pk.imports:
@@ -762,6 +892,8 @@ class RouterGenerator:
             ops_const=ops_const,
             model_name=f"{short_name}Create",
             patch_model=f"{short_name}Patch",
+            create_autoset=create_autoset,
+            update_autoset=update_autoset,
         )
         for i, hname in enumerate(("list", "get", "create", "update", "delete")):
             if i > 0:

{metaobjects-0.19.3 → metaobjects-0.19.5}/tests/codegen/test_cli_verify_subverbs.py

@@ -79,6 +79,46 @@ def _templates_dir(tmp_path: Path, body: str) -> str:
     return str(root)
 
 
+# An email `template.output` (@kind=email) carries subject + html body part-refs
+# (NO @textRef). Each part's mustache must be drift-checked against the payload VO,
+# parity with a document output and template.prompt (#193).
+_META_EMAIL = """\
+{
+  "metadata.root": {
+    "package": "acme::ai",
+    "children": [
+      {
+        "object.value": {
+          "name": "Welcome",
+          "children": [
+            { "field.string": { "name": "name", "@required": true } }
+          ]
+        }
+      },
+      {
+        "template.output": {
+          "name": "WelcomeEmail",
+          "@kind": "email",
+          "@payloadRef": "Welcome",
+          "@subjectRef": "emails/subject",
+          "@htmlBodyRef": "emails/html"
+        }
+      }
+    ]
+  }
+}
+"""
+
+
+def _email_templates_dir(tmp_path: Path, subject: str, html: str) -> str:
+    """Write a templates root with the email subject + html body parts."""
+    root = tmp_path / "email_templates"
+    (root / "emails").mkdir(parents=True)
+    (root / "emails" / "subject.mustache").write_text(subject)
+    (root / "emails" / "html.mustache").write_text(html)
+    return str(root)
+
+
 def _meta_dir_with(tmp_path: Path, meta_json: str) -> str:
     d = tmp_path / "tmeta"
     d.mkdir()
@@ -135,6 +175,76 @@ def test_templates_unresolvable_ref_is_drift(tmp_path: Path) -> None:
     assert rc != 0
 
 
+def test_templates_email_clean_returns_zero(tmp_path: Path) -> None:
+    # An @kind=email output whose subject + html parts reference only payload
+    # fields is clean (#193 — email parts drift-checked like a document body).
+    meta_dir = _meta_dir_with(tmp_path, _META_EMAIL)
+    troot = _email_templates_dir(tmp_path, "Hello {{name}}", "<p>Hi {{name}}</p>")
+    rc = main(["verify", "--templates", meta_dir, "--templates-root", troot])
+    assert rc == 0
+
+
+def test_templates_email_body_drift_is_caught(tmp_path: Path, capsys) -> None:
+    # A {{missing}} in the email HTML body part must be reported (#193): the
+    # per-port bug was skipping @kind=email templates entirely.
+    meta_dir = _meta_dir_with(tmp_path, _META_EMAIL)
+    troot = _email_templates_dir(tmp_path, "Hello {{name}}", "<p>Hi {{missing}}</p>")
+    rc = main(["verify", "--templates", meta_dir, "--templates-root", troot])
+    assert rc != 0
+    err = capsys.readouterr().err
+    assert "missing" in err
+    assert "WelcomeEmail" in err
+
+
+# --- #230: template.prompt @requiredTags / @requiredSlots enforcement (parity w/ TS/Java/C#) ---
+
+_META_PROMPT_TAGS = """\
+{
+  "metadata.root": {
+    "package": "acme::ai",
+    "children": [
+      {
+        "object.value": {
+          "name": "Welcome",
+          "children": [
+            { "field.string": { "name": "name", "@required": true } }
+          ]
+        }
+      },
+      {
+        "template.prompt": {
+          "name": "TaggedPrompt",
+          "@payloadRef": "Welcome",
+          "@textRef": "pages/welcome",
+          "@requiredTags": ["answer"]
+        }
+      }
+    ]
+  }
+}
+"""
+
+
+def test_templates_prompt_required_tag_missing_is_drift(tmp_path: Path, capsys) -> None:
+    # #230: a template.prompt @requiredTags whose rendered body omits the <answer> tag must FAIL
+    # verify. Python previously passed required_slots/required_tags to render_verify NOWHERE, so it
+    # enforced neither — a divergence from TS/Java/C#.
+    meta_dir = _meta_dir_with(tmp_path, _META_PROMPT_TAGS)
+    troot = _templates_dir(tmp_path, "Hello {{name}}")  # no <answer>…</answer> tag
+    rc = main(["verify", "--templates", meta_dir, "--templates-root", troot])
+    assert rc != 0
+    err = capsys.readouterr().err
+    assert "ERR_OUTPUT_TAG_MISSING" in err
+    assert "answer" in err
+
+
+def test_templates_prompt_required_tag_present_passes(tmp_path: Path) -> None:
+    meta_dir = _meta_dir_with(tmp_path, _META_PROMPT_TAGS)
+    troot = _templates_dir(tmp_path, "Hello {{name}} <answer>{{name}}</answer>")
+    rc = main(["verify", "--templates", meta_dir, "--templates-root", troot])
+    assert rc == 0
+
+
 # --- 3. bare verify = codegen (back-compat) + the subverb note --------------
 
 

metaobjects-0.19.5/tests/codegen/test_router_autoset.py

@@ -0,0 +1,168 @@
+"""#203 / ADR-0045 — the generated FastAPI router (the deployed API surface) stamps
+``@autoSet`` timestamps ABOVE the consumer repository seam, so an adopter who wires
+their own persistence into the generated router still gets the shipped stamping
+semantics. (The ObjectManager keeps stamping for non-HTTP writes — defense-in-depth,
+not the wire-tier guarantee.) A non-``@autoSet`` entity's router stays byte-identical."""
+
+from __future__ import annotations
+
+import shutil
+import tempfile
+from pathlib import Path
+
+from metaobjects import MetaDataLoader
+from metaobjects.codegen.generators.m2m_codegen import build_object_index
+from metaobjects.codegen.generators.router_generator import render_router
+from metaobjects.meta.core.object.meta_object import MetaObject
+from metaobjects.shared.base_types import TYPE_OBJECT
+
+# Event declares both @autoSet policies on field.timestamp columns; Note declares none
+# (the byte-identical baseline).
+_AUTOSET_FIXTURE = """{
+  "metadata.root": { "package": "acme::events", "children": [
+    { "object.entity": { "name": "Event", "children": [
+        { "source.rdb":      { "@table": "events" } },
+        { "field.long":      { "name": "id" } },
+        { "field.string":    { "name": "name", "@required": true, "@maxLength": 120 } },
+        { "field.timestamp": { "name": "createdAt", "@autoSet": "onCreate" } },
+        { "field.timestamp": { "name": "updatedAt", "@autoSet": "onUpdate" } },
+        { "identity.primary": { "@fields": "id", "@generation": "increment" } }
+    ] } },
+    { "object.entity": { "name": "Note", "children": [
+        { "source.rdb":      { "@table": "notes" } },
+        { "field.long":      { "name": "id" } },
+        { "field.string":    { "name": "title", "@required": true, "@maxLength": 200 } },
+        { "identity.primary": { "@fields": "id", "@generation": "increment" } }
+    ] } }
+  ] }
+}"""
+
+
+def _load(fixture: str) -> dict[str, MetaObject]:
+    tmp = Path(tempfile.mkdtemp(prefix="router-autoset-"))
+    try:
+        (tmp / "meta.events.json").write_text(fixture)
+        result = MetaDataLoader.from_directory(str(tmp))
+        assert not result.errors, [f"{e.code}: {e.message}" for e in result.errors]
+        return {
+            c.name: c
+            for c in result.root.children()
+            if c.type == TYPE_OBJECT and isinstance(c, MetaObject)
+        }
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+
+
+_ENTITIES = _load(_AUTOSET_FIXTURE)
+_INDEX = build_object_index(list(_ENTITIES.values()))
+
+
+def test_router_create_stamps_both_autoset_columns_from_one_instant() -> None:
+    src = render_router(_ENTITIES["Event"], _INDEX)
+    assert src is not None
+    assert "import datetime as _dt" in src
+    # ONE captured base instant, assigned to BOTH columns → a fresh row's createdAt == updatedAt.
+    assert "_asnow = _dt.datetime.now(_dt.timezone.utc)" in src
+    assert 'dto["createdAt"] = _asnow' in src
+    assert 'dto["updatedAt"] = _asnow' in src
+
+
+def test_router_update_bumps_only_onupdate() -> None:
+    src = render_router(_ENTITIES["Event"], _INDEX)
+    assert src is not None
+    update_body = src.split("def update_")[1].split("def delete_")[0]
+    # the update handler bumps updatedAt; createdAt is never stamped on update (immutable).
+    assert 'dto["updatedAt"] = _asnow' in update_body
+    assert 'dto["createdAt"] = ' not in update_body
+    # #203/ADR-0045 integrity: a caller-supplied onCreate @autoSet value is STRIPPED on PATCH
+    # (write-once — cannot be mutated via the deployed API), so it never reaches repo.update.
+    assert 'dto.pop("createdAt", None)' in update_body
+
+
+def test_non_autoset_router_is_byte_identical() -> None:
+    src = render_router(_ENTITIES["Note"], _INDEX)
+    assert src is not None
+    assert "import datetime as _dt" not in src
+    assert "_asnow" not in src
+    assert "_dt.datetime.now" not in src
+
+
+# ---- FR-017 TPH: the per-subtype router also stamps @autoSet (#203/#229) ----------------
+#
+# The base `Auth` declares both @autoSet policies on field.timestamp columns (shared by
+# every subtype via `extends`); `PlainAuth` declares none (the byte-identical baseline).
+
+TPH_AUTOSET = """
+{ "metadata.root": { "package": "acme::auth", "children": [
+  { "object.entity": { "name": "Auth", "@discriminator": "type", "children": [
+    { "source.rdb": { "@table": "auths" } },
+    { "field.long": { "name": "id" } },
+    { "field.enum": { "name": "type", "@values": ["Bridge"] } },
+    { "field.string": { "name": "reference", "@required": true, "@maxLength": 80 } },
+    { "field.timestamp": { "name": "autoCreatedAt", "@autoSet": "onCreate" } },
+    { "field.timestamp": { "name": "autoUpdatedAt", "@autoSet": "onUpdate" } },
+    { "identity.primary": { "name": "id", "@fields": "id", "@generation": "increment" } }
+  ]}},
+  { "object.entity": { "name": "BridgeAuth", "extends": "Auth", "@discriminatorValue": "Bridge", "children": [
+    { "field.int": { "name": "quantity", "@required": true } }
+  ]}}
+]}}
+"""
+
+TPH_PLAIN = """
+{ "metadata.root": { "package": "acme::auth", "children": [
+  { "object.entity": { "name": "Auth", "@discriminator": "type", "children": [
+    { "source.rdb": { "@table": "auths" } },
+    { "field.long": { "name": "id" } },
+    { "field.enum": { "name": "type", "@values": ["Bridge"] } },
+    { "field.string": { "name": "reference", "@required": true, "@maxLength": 80 } },
+    { "identity.primary": { "name": "id", "@fields": "id", "@generation": "increment" } }
+  ]}},
+  { "object.entity": { "name": "BridgeAuth", "extends": "Auth", "@discriminatorValue": "Bridge", "children": [
+    { "field.int": { "name": "quantity", "@required": true } }
+  ]}}
+]}}
+"""
+
+
+def _render_tph(fixture: str, name: str) -> str:
+    """Load *fixture*, build the object index, and render *name*'s (the TPH base's)
+    router — dispatched to ``_render_tph_router`` inside ``render_router`` once a
+    discriminator plan resolves for it."""
+    entities = _load(fixture)
+    index = build_object_index(list(entities.values()))
+    src = render_router(entities[name], index)
+    assert src is not None
+    return src
+
+
+def _handler_body(src: str, def_line: str) -> str:
+    """Slice out one handler's source, from *def_line* up to (not including) the next
+    top-level ``def `` (the next handler in the module)."""
+    after = src.split(def_line, 1)[1]
+    return after.split("\ndef ", 1)[0]
+
+
+def test_tph_router_imports_datetime_when_autoset_present() -> None:
+    src = _render_tph(TPH_AUTOSET, "Auth")
+    assert "import datetime as _dt" in src
+
+
+def test_tph_per_subtype_create_stamps_both_autoset_columns() -> None:
+    body = _handler_body(_render_tph(TPH_AUTOSET, "Auth"), "def create_auths_bridge")
+    assert "_asnow = _dt.datetime.now(_dt.timezone.utc)" in body
+    assert 'dto["autoCreatedAt"] = _asnow' in body
+    assert 'dto["autoUpdatedAt"] = _asnow' in body
+
+
+def test_tph_per_subtype_update_pops_oncreate_and_bumps_onupdate() -> None:
+    body = _handler_body(_render_tph(TPH_AUTOSET, "Auth"), "def update_auths_bridge")
+    assert 'dto.pop("autoCreatedAt", None)' in body
+    assert 'dto["autoUpdatedAt"] = _asnow' in body
+    assert 'dto["autoCreatedAt"] = ' not in body
+
+
+def test_tph_router_without_autoset_is_byte_identical() -> None:
+    src = _render_tph(TPH_PLAIN, "Auth")
+    assert "import datetime as _dt" not in src
+    assert "_asnow" not in src