metaobjects 1.0.5rc11__tar.gz → 1.0.7__tar.gz

{metaobjects-1.0.5rc11 → metaobjects-1.0.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: metaobjects
-Version: 1.0.5rc11
+Version: 1.0.7
 Summary: Cross-language metadata standard: declare typed entities once, generate idiomatic drift-checked code across languages — Python port.
 Project-URL: Homepage, https://metaobjects.dev
 Project-URL: Repository, https://github.com/metaobjectsdev/metaobjects
@@ -78,7 +78,8 @@ else:
 The primary public API is the **loader** (`load_directory` / `load_uris` /
 `load_string`, `MetaDataLoader`, `LoadResult`, `ErrorCode`, `MetaError`). The
 distribution also ships the Python implementations of the other pillars used by the CLI
-and tooling: `codegen` (Pydantic + FastAPI emit), `render` (Mustache + payload-VO +
+and tooling: `codegen` (Pydantic + FastAPI emit — reference generators you own:
+`metaobjects eject <name>` copies one into your repo), `render` (Mustache + payload-VO +
 verify), and `runtime` (a DB-API 2 `ObjectManager` — pg8000 / psycopg — no SQLAlchemy).
 Schema migrations are owned by the TypeScript `meta` CLI (ADR-0015); there is
 **no `migrate` module** in this distribution.

{metaobjects-1.0.5rc11 → metaobjects-1.0.7}/README.md

@@ -43,7 +43,8 @@ else:
 The primary public API is the **loader** (`load_directory` / `load_uris` /
 `load_string`, `MetaDataLoader`, `LoadResult`, `ErrorCode`, `MetaError`). The
 distribution also ships the Python implementations of the other pillars used by the CLI
-and tooling: `codegen` (Pydantic + FastAPI emit), `render` (Mustache + payload-VO +
+and tooling: `codegen` (Pydantic + FastAPI emit — reference generators you own:
+`metaobjects eject <name>` copies one into your repo), `render` (Mustache + payload-VO +
 verify), and `runtime` (a DB-API 2 `ObjectManager` — pg8000 / psycopg — no SQLAlchemy).
 Schema migrations are owned by the TypeScript `meta` CLI (ADR-0015); there is
 **no `migrate` module** in this distribution.

{metaobjects-1.0.5rc11 → metaobjects-1.0.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "metaobjects"
-version = "1.0.5rc11"
+version = "1.0.7"
 description = "Cross-language metadata standard: declare typed entities once, generate idiomatic drift-checked code across languages — Python port."
 readme = "README.md"
 requires-python = ">=3.11"

{metaobjects-1.0.5rc11 → metaobjects-1.0.7}/src/metaobjects/codegen/generators/router_generator.py

@@ -431,6 +431,32 @@ def _sort_parse_fn_lines() -> list[str]:
     ]
 
 
+def _auth_docstring_paragraph(*, read_only: bool) -> str:
+    """The auth-seam paragraph appended to every generated router's module docstring
+    (#367). A generated router is unauthenticated by construction — the consumer wires
+    a dependency onto `app.include_router` — and until this, nothing in the emitted
+    module said so, mirroring the gap the TS route generators closed for #367 with a
+    doc-comment above the register function. Python has no `expose` option to narrow a
+    generated router down to a safe subset (non-TS REST templates are frozen for
+    features), so the escape hatch for anything a dependency cannot express — a
+    row-ownership rule — is `metaobjects eject`, not a narrowing flag.
+
+    *read_only* only swaps "these endpoints" for "these read endpoints" on a
+    projection's GET-only surface; the guidance is otherwise identical. Returned text
+    starts and ends with a newline so a caller can splice it directly between the
+    docstring's summary line and the closing `\"\"\"`."""
+    verbs = "read endpoints" if read_only else "endpoints"
+    return (
+        "\n"
+        f"Auth: these {verbs} are unauthenticated. To guard them, include the router with a\n"
+        "dependency, e.g. `app.include_router(router, dependencies=[Depends(require_auth)])`.\n"
+        "\n"
+        'A row-ownership rule ("only the owner may read this row") cannot be expressed as a\n'
+        "router dependency: eject this generator with `metaobjects eject` and hand-write\n"
+        "those endpoints.\n"
+    )
+
+
 class RouterGenerator:
     """One ``<entity_snake>_router.py`` per routed object (FastAPI ``APIRouter``):
     full CRUD for a writable source, read-only for a view-backed one.
@@ -882,7 +908,9 @@ class RouterGenerator:
         parts.append(
             h + "\n"
             + f'"""GENERATED — TPH polymorphic REST router for the {short_name} hierarchy '
-            + '(single-table inheritance: polymorphic base + per-subtype CRUD)."""\n'
+            + '(single-table inheritance: polymorphic base + per-subtype CRUD).\n'
+            + _auth_docstring_paragraph(read_only=False)
+            + '"""\n'
         )
         parts.append("from __future__ import annotations")
         parts.append("")
@@ -1232,7 +1260,9 @@ class RouterGenerator:
         parts: list[str] = []
         parts.append(
             generated_header(short_name, _effective_fqn(entity)).rstrip() + "\n"
-            + f'"""GENERATED — REST router for {short_name} entity. Implements the cross-port API contract."""\n'
+            + f'"""GENERATED — REST router for {short_name} entity. Implements the cross-port API contract.\n'
+            + _auth_docstring_paragraph(read_only=False)
+            + '"""\n'
         )
         parts.append("from __future__ import annotations")
         parts.append("")
@@ -1401,7 +1431,9 @@ class RouterGenerator:
             generated_header(short_name, _effective_fqn(entity)).rstrip() + "\n"
             + f'"""GENERATED — read-only REST router for the {short_name} projection.\n\n'
             + "Implements the cross-port API contract: GET list + GET by id; every write\n"
-            + 'verb answers 405 {"error": "method_not_allowed"}."""\n'
+            + 'verb answers 405 {"error": "method_not_allowed"}.\n'
+            + _auth_docstring_paragraph(read_only=True)
+            + '"""\n'
         )
         parts.append("from __future__ import annotations")
         parts.append("")

{metaobjects-1.0.5rc11 → metaobjects-1.0.7}/src/metaobjects/render/extract/extract.py

@@ -45,7 +45,7 @@ def extract(
     span: str | None
     raw: dict[str, object]
     if schema.format == Format.JSON:
-        span = _locate.json(stripped)
+        span = _select_json(text, stripped, schema.fields, ci)
         raw = {} if span is None else JsonForgivingReader().read(span)
     elif o.rootless:
         span = None if stripped == "" else stripped
@@ -199,12 +199,39 @@ def _extract_value(
     # A text element that also carried XML attributes is represented by XmlForgivingReader
     # as a dict with the body under TEXT_KEY. A scalar field reads that text (attributes
     # ignored for scalars — preserving pre-attribute-support behaviour).
-    if isinstance(present, dict) and TEXT_KEY in present:
+    if isinstance(present, dict):
+        # An element with no text of its own (only child elements) is not a scalar value.
+        # Never stringify the dict: that delivered "{'child': ...}" as the field's text.
+        if TEXT_KEY not in present:
+            return MALFORMED
         present = present[TEXT_KEY]
     raw_str = present if isinstance(present, str) else str(present)
     return _coerce.value(raw_str, f, o, path, report)
 
 
+def _select_json(
+    text: str | None, stripped: str, fields: list[FieldSpec], ci: bool
+) -> str | None:
+    """Pick the JSON object that answers the schema. Fenced blocks are searched first, then
+    the whole reply, and the first object carrying at least one declared field wins, so a
+    draft object, an echoed format example or a brace in prose no longer shadows the real
+    answer (#363). A fenced object with none of the declared fields falls through the same
+    way. When nothing carries a declared field, the first-object rule (``locate.json``)
+    decides."""
+    for region in [*_strip.fenced_bodies(text), stripped]:
+        for candidate in _locate.json_candidates(region):
+            parsed = JsonForgivingReader().read(candidate)
+            if any(_carries(parsed, f.name, ci) for f in fields):
+                return candidate
+    return _locate.json(stripped)
+
+
+def _carries(raw: dict[str, object], name: str, ci: bool) -> bool:
+    if name in raw:
+        return True
+    return ci and any(k.lower() == name.lower() for k in raw)
+
+
 def _lookup(raw: dict[str, object], name: str, ci: bool) -> object | None:
     """Case-folding lookup honoring tolerance."""
     if name in raw:

{metaobjects-1.0.5rc11 → metaobjects-1.0.7}/src/metaobjects/render/extract/locate.py

@@ -1,6 +1,7 @@
 """Stages 2-3: isolate and select the payload root span.
 
-Selection rule: first-closed-else-first-open.
+JSON: extract picks among json_candidates by the schema (fenced first, first object carrying a
+declared field); json() (first-closed-else-first-open) is its fallback.
 """
 from __future__ import annotations
 
@@ -22,6 +23,28 @@ def json(text: str | None) -> str | None:
     return None if first_open < 0 else text[first_open:]
 
 
+def json_candidates(text: str | None) -> list[str]:
+    """Every top-level object span in ``text``, in order: each balanced {...} (nested objects
+    are part of their parent, not separate spans), and, for a '{' that never closes, the text
+    from it to the end."""
+    out: list[str] = []
+    if text is None:
+        return out
+    tail_added = False
+    i = 0
+    while i < len(text):
+        if text[i] == "{":
+            end = _scan_balanced(text, i)
+            if end >= 0:
+                out.append(text[i : end + 1])
+                i = end
+            elif not tail_added:
+                out.append(text[i:])
+                tail_added = True
+        i += 1
+    return out
+
+
 def _scan_balanced(s: str, open_idx: int) -> int:
     """Return index of the matching ``}``, or -1 if unterminated. String-aware."""
     depth = 0

{metaobjects-1.0.5rc11 → metaobjects-1.0.7}/src/metaobjects/render/extract/strip.py

@@ -18,3 +18,11 @@ def strip(raw: str | None) -> str:
     if m:
         return (raw[: m.start()] + m.group(1) + raw[m.end():]).strip()
     return raw.strip()
+
+
+def fenced_bodies(raw: str | None) -> list[str]:
+    """The body of every fenced block, in order. Locate searches these before the whole
+    text, because a model told to fence its answer puts the answer there."""
+    if raw is None:
+        return []
+    return [m.group(1) for m in _FENCE.finditer(raw)]

{metaobjects-1.0.5rc11 → metaobjects-1.0.7}/src/metaobjects/render/extract/xml_forgiving_reader.py

@@ -31,6 +31,10 @@ TEXT_KEY = "#text"
 # self-closing tag). Non-greedy so the first '>' closes the open tag.
 _OPEN_TAG = re.compile(r"<([A-Za-z_][A-Za-z0-9_]*)([^>]*?)>")
 _OPEN_TAG_CI = re.compile(r"<([A-Za-z_][A-Za-z0-9_]*)([^>]*?)>", re.IGNORECASE)
+# a closing tag. Used to spot a STRAY close (of an element whose open never appeared in
+# the body) — LLMs commonly end a block with the wrong tag.
+_CLOSE_TAG = re.compile(r"</([A-Za-z_][A-Za-z0-9_]*)\s*>")
+_CLOSE_TAG_CI = re.compile(r"</([A-Za-z_][A-Za-z0-9_]*)\s*>", re.IGNORECASE)
 # one attribute: name = "double" | 'single' | bareword.
 _ATTR = re.compile(r"""([A-Za-z_:][A-Za-z0-9_:.\-]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s/>]+))""")
 
@@ -46,7 +50,7 @@ class XmlForgivingReader:
         root_end = span.rfind("</")
         inner_end = len(span) if (root_end < 0 or root_end <= gt) else root_end
         inner = span[gt + 1 : inner_end]
-        self._parse_children(inner, case_insensitive, out)
+        self._parse_children(inner, case_insensitive, out, None)
         return out
 
     def read_rootless(self, text: str | None, case_insensitive: bool) -> dict[str, object]:
@@ -57,16 +61,23 @@ class XmlForgivingReader:
         out: dict[str, object] = {}
         if text is None or text.strip() == "":
             return out
-        self._parse_children(text, case_insensitive, out)
+        self._parse_children(text, case_insensitive, out, None)
         return out
 
-    def _parse_children(self, inner: str, ci: bool, out: dict[str, object]) -> None:
+    def _parse_children(
+        self, inner: str, ci: bool, out: dict[str, object], loose: list[str] | None
+    ) -> None:
+        """Parse ``inner``'s elements into ``out``. When ``loose`` is not ``None``, the text
+        BETWEEN those elements (an element's own text in mixed content) is appended to it,
+        one segment per gap."""
         open_tag = _OPEN_TAG_CI if ci else _OPEN_TAG
         pos = 0
         while True:
             m = open_tag.search(inner, pos)
             if m is None:
-                return
+                break
+            if loose is not None:
+                loose.append(inner[pos : m.start()])
             tag = m.group(1)
             key = tag.lower() if ci else tag
 
@@ -112,22 +123,67 @@ class XmlForgivingReader:
                 else:
                     content_end = len(inner)
                     nxt = len(inner)
+                # A STRAY close tag of another element inside the unclosed element's body
+                # ends the body there (the model closed the block with the wrong tag), and
+                # the stray tag itself is dropped rather than kept as literal text.
+                stray = self._find_stray_close(inner, content_start, content_end, ci)
+                if stray is not None:
+                    content_end, nxt = stray
             content = inner[content_start:content_end]
             self._accumulate(out, key, self._combine(attrs, content, ci))
             pos = nxt
+        if loose is not None:
+            loose.append(inner[pos:])
+
+    def _find_stray_close(
+        self, inner: str, from_: int, to: int, ci: bool
+    ) -> tuple[int, int] | None:
+        """The first close tag in ``inner[from_, to)`` whose element was never opened
+        after ``from_`` — a stray close — as ``(start, end)``, or ``None``. A close whose
+        open DID appear is a nested child's own close, not stray."""
+        close_re = _CLOSE_TAG_CI if ci else _CLOSE_TAG
+        at = from_
+        while True:
+            m = close_re.search(inner, at, to)
+            if m is None:
+                return None
+            open_re = re.compile(
+                "<" + re.escape(m.group(1)) + r"(?=[\s/>])", re.IGNORECASE if ci else 0
+            )
+            if open_re.search(inner, from_, m.start()) is None:
+                return (m.start(), m.end())
+            at = m.end()
 
     def _combine(self, attrs: dict[str, object], content: str, ci: bool) -> object:
-        """Combine an element's attributes with its body (nested children or plain text)."""
+        """Combine an element's attributes with its body (nested children or plain text).
+        Mixed content keeps BOTH: the children, and the element's own text under
+        :data:`TEXT_KEY`, so a scalar or ``@xmlText`` consumer still reads the prose
+        around a child element."""
         if "<" in content:
             nested: dict[str, object] = {}
-            self._parse_children(content, ci, nested)
+            loose: list[str] = []
+            self._parse_children(content, ci, nested, loose)
             if nested:
                 # attributes first; a child element wins a name collision
                 merged: dict[str, object] = dict(attrs)
                 merged.update(nested)
+                text = self._mixed_text(loose, ci)
+                if text:
+                    merged[TEXT_KEY] = text
                 return merged
         return self._text_value(attrs, content)
 
+    def _mixed_text(self, segments: list[str], ci: bool) -> str:
+        """The text segments between child elements: stray close tags dropped, each
+        trimmed, the non-empty ones joined with a single space."""
+        close_re = _CLOSE_TAG_CI if ci else _CLOSE_TAG
+        parts: list[str] = []
+        for seg in segments:
+            t = close_re.sub("", seg).strip()
+            if t:
+                parts.append(t)
+        return " ".join(parts)
+
     def _text_value(self, attrs: dict[str, object], content: str) -> object:
         text = content.strip()
         if not attrs:

{metaobjects-1.0.5rc11 → metaobjects-1.0.7}/tests/conformance/test_extract_conformance.py

@@ -6,7 +6,7 @@ Each fixture dir under ``fixtures/extract-conformance/`` holds:
 - ``input.txt``     the raw (possibly dirty) LLM output
 - ``expected.json`` ``{ "empty": bool, "states": {field: FieldExtraction}, "data": {field: value} }``
 
-All 22 cases must pass. The corpus is the oracle — do not weaken assertions.
+All cases must pass. The corpus is the oracle — do not weaken assertions.
 1:1 port of ``ExtractConformanceTest.java`` / ``ExtractConformanceTests.cs``.
 """
 from __future__ import annotations
@@ -60,7 +60,7 @@ def _cases() -> list[str]:
 def test_discovers_all_extract_conformance_cases() -> None:
     """FR-011: lock the corpus size so a deleted fixture fails CI rather than
     silently reducing coverage. Mirrors the TS / Java / C# count guards."""
-    assert len(_cases()) == 33
+    assert len(_cases()) == 41
 
 
 _NORMALIZE_MODES = {"none", "collapse", "strip"}

{metaobjects-1.0.5rc11 → metaobjects-1.0.7}/uv.lock

@@ -250,7 +250,7 @@ wheels = [
 
 [[package]]
 name = "metaobjects"
-version = "1.0.4"
+version = "1.0.7"
 source = { editable = "." }
 dependencies = [
     { name = "pyyaml" },