Merge #234: @lenient opt-out on field.uri/field.inet + strict cross-port pin

Coordinated PATCH (npm 0.20.6 / PyPI 0.19.8 / NuGet 0.19.6 / Maven 7.11.6).

- Strict field.uri/field.inet accept/reject pinned identical across all 5 ports
  (fixes C#/Java/Kotlin relative-URI acceptance + the JVM inet-DNS lookup bug).
- @lenient:true degrades to a plain string (lenient field.inet → text column).
- Fixes a latent Zod-4 field.inet codegen bug (z.string().ip() was removed).
- Adversarial review caught + fixed 2 cross-port parser divergences (leading-zero
  IPv4 silent-rewrite; TS-rejected IPv4-mapped IPv6) the probe set had missed.

validation-conformance 40 cases green on all 5 ports; full suites green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014xy8powhHYJ6gfFt9Ut8dL

Author: dmealing

CHANGELOG.md

@@ -7,6 +7,37 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+### Added — `@lenient` opt-out on `field.uri` / `field.inet`; strict well-formedness pinned cross-port (#234)
+
+**Coordinated PATCH** (npm / PyPI / NuGet / Maven Central). Two halves, one release:
+
+- **Strict accept/reject is now pinned and identical across all five ports** (on the shared
+  `validation-conformance` probe set, which spans the URI/IP-literal edge cases — scheme-less,
+  relative, garbage, empty-authority, leading-zero octet, IPv4-mapped IPv6, CIDR, padding).
+  A `field.uri` must be an
+  **absolute, scheme-bearing URI** (`https://a.com`, `mailto:a@b`, `urn:…`; a scheme-less
+  `example.com` or a bare `/path` is rejected) and a `field.inet` must be an **IPv4/IPv6 literal**
+  (no hostnames, no CIDR, no padding). Previously the ports diverged: C#/Java/Kotlin accepted
+  relative URIs, and the JVM ports resolved **hostnames into `field.inet` via a live DNS lookup on
+  the request path** (blocking I/O, a network-dependent verdict, and a silent value rewrite) — now
+  fixed. Enforcement lives at each port's wire/bind layer via small generated, dependency-free
+  support files (`MetaNetBindings.java` / `MetaNetJson.kt` / `MetaNetValidation.cs`; TS keeps its
+  Zod check, Python its Pydantic type). **This is a wire-acceptance change for existing C#/Java/Kotlin
+  deployments** that were accepting values now rejected — the escape hatch ships in the same release:
+- **`@lenient: true`** (a new optional boolean attribute on `field.uri` / `field.inet`, registered
+  cross-port + gated by `registry-conformance`) opts a field **out** of strict enforcement: codegen
+  binds a plain string (no URL/IP validator, no native `URI`/`InetAddress` type) so a
+  not-necessarily-well-formed value — an LLM-emitted citation URL, a user-supplied host — round-trips
+  unchanged. A `field.inet @lenient` additionally uses a plain `text` column instead of the native
+  `inet` type, so **toggling `@lenient` on an existing `field.inet` is schema-affecting** (an `ALTER`
+  on the next `meta migrate`). Strict remains the default (attr absent/false → byte-identical output).
+
+Gated by the shared `validation-conformance` corpus (strict accept/reject + `@lenient` accept-garbage,
+identical boolean verdicts on all five ports) and a real-Postgres idempotence + value-semantics
+round-trip for the lenient-inet `text` column. Also fixes a **latent Zod-4 bug**: `field.inet` codegen
+emitted `z.string().ip()`, which was removed in Zod 4 (the workspace + generated consumers run Zod 4);
+it now emits a version-agnostic IPv4/IPv6 regex union valid on both Zod 3 and Zod 4.
+
 ## [0.20.5] — 2026-07-26
 
 **Coordinated release** — npm `0.20.5` · PyPI `0.19.7` · Maven Central `7.11.5` · NuGet

agent-context/skills/metaobjects-authoring/SKILL.md

@@ -313,8 +313,8 @@ Canonical form for common field needs — reach for these before inventing anyth
 | Long / unbounded text | bare `field.string` | add `@maxLength` only when you want `varchar(N)` |
 | Nested structured value | `field.object` | `@objectRef` + `@storage` |
 | Open JSON bag (no fixed shape) | `field.string` + `@dbColumnType: jsonb` | logical type stays string; column is jsonb |
-| URL / URI | `field.uri` | native `URI`/`Uri`; `text` column; URL validation — a real native type + behavior, so a subtype (not a validated string) |
-| IP address | `field.inet` | native IP type; Postgres `inet` column |
+| URL / URI | `field.uri` | native `URI`/`Uri`; `text` column; strict absolute-URI validation (add `@lenient: true` to store any string) — a real native type + behavior, so a subtype (not a validated string) |
+| IP address | `field.inet` | native IP type; Postgres `inet` column; strict IPv4/IPv6-literal validation (add `@lenient: true` for a plain-string `text` column) |
 | Validated plain string (email / hostname) | `field.string` + `@stringFormat` | `@stringFormat: email` or `@stringFormat: hostname` — idiomatic per-port validation; don't hand-write the `validator.regex` |
 
 **UUID columns are `field.uuid` — `field.string` + `@dbColumnType: uuid` is a forbidden smell.**
@@ -352,6 +352,24 @@ lives in `field.timestamp` (instant by default) + the `@localTime` naive opt-out
 { "field.timestamp": { "name": "opensAt", "@localTime": true } }
 ```
 
+**URIs / IPs — strict by default, `@lenient` to store any string (#234).** `field.uri` is a
+strict **absolute, scheme-bearing URI** (`https://a.com`, `mailto:a@b`; a scheme-less
+`example.com` or a bare `/path` is rejected) and `field.inet` is a strict **IPv4/IPv6 literal**
+(no hostnames, no CIDR). When a field must hold a *not-necessarily-well-formed* value — an
+LLM-emitted citation URL, a user-supplied host that might be a name — add **`@lenient: true`**:
+codegen then binds a plain string (no URL/IP validator) and a `field.inet @lenient` uses a plain
+`text` column instead of the native `inet` type (so a value the native column would reject at
+INSERT round-trips unchanged). Strict is the default; `@lenient` is the deliberate opt-out (never
+default-true — the same shape as `@localTime`). **Toggling `@lenient` on an existing `field.inet`
+is schema-affecting** (`inet` ⇄ `text`), so it shows up as an `ALTER` on the next `meta migrate`.
+
+```json
+{ "field.uri":  { "name": "homepage" } }                       // strict — must be an absolute URL
+{ "field.uri":  { "name": "citationUrl", "@lenient": true } }  // any string (LLM-emitted, may be malformed)
+{ "field.inet": { "name": "sourceIp" } }                       // strict — IPv4/IPv6 literal only
+{ "field.inet": { "name": "reportedHost", "@lenient": true } } // any string; text column
+```
+
 **`@autoSet` — let the runtime stamp created/updated times; never hand-set them.**
 `@autoSet` is registered on the temporal subtypes (`field.date` / `field.time` /
 `field.timestamp`) and takes **`onCreate`** (stamp on insert) or **`onUpdate`**

fixtures/agent-context-conformance/java-kotlin-react-tanstack/expected/.claude/skills/metaobjects-authoring/SKILL.md

@@ -313,8 +313,8 @@ Canonical form for common field needs — reach for these before inventing anyth
 | Long / unbounded text | bare `field.string` | add `@maxLength` only when you want `varchar(N)` |
 | Nested structured value | `field.object` | `@objectRef` + `@storage` |
 | Open JSON bag (no fixed shape) | `field.string` + `@dbColumnType: jsonb` | logical type stays string; column is jsonb |
-| URL / URI | `field.uri` | native `URI`/`Uri`; `text` column; URL validation — a real native type + behavior, so a subtype (not a validated string) |
-| IP address | `field.inet` | native IP type; Postgres `inet` column |
+| URL / URI | `field.uri` | native `URI`/`Uri`; `text` column; strict absolute-URI validation (add `@lenient: true` to store any string) — a real native type + behavior, so a subtype (not a validated string) |
+| IP address | `field.inet` | native IP type; Postgres `inet` column; strict IPv4/IPv6-literal validation (add `@lenient: true` for a plain-string `text` column) |
 | Validated plain string (email / hostname) | `field.string` + `@stringFormat` | `@stringFormat: email` or `@stringFormat: hostname` — idiomatic per-port validation; don't hand-write the `validator.regex` |
 
 **UUID columns are `field.uuid` — `field.string` + `@dbColumnType: uuid` is a forbidden smell.**
@@ -352,6 +352,24 @@ lives in `field.timestamp` (instant by default) + the `@localTime` naive opt-out
 { "field.timestamp": { "name": "opensAt", "@localTime": true } }
 ```
 
+**URIs / IPs — strict by default, `@lenient` to store any string (#234).** `field.uri` is a
+strict **absolute, scheme-bearing URI** (`https://a.com`, `mailto:a@b`; a scheme-less
+`example.com` or a bare `/path` is rejected) and `field.inet` is a strict **IPv4/IPv6 literal**
+(no hostnames, no CIDR). When a field must hold a *not-necessarily-well-formed* value — an
+LLM-emitted citation URL, a user-supplied host that might be a name — add **`@lenient: true`**:
+codegen then binds a plain string (no URL/IP validator) and a `field.inet @lenient` uses a plain
+`text` column instead of the native `inet` type (so a value the native column would reject at
+INSERT round-trips unchanged). Strict is the default; `@lenient` is the deliberate opt-out (never
+default-true — the same shape as `@localTime`). **Toggling `@lenient` on an existing `field.inet`
+is schema-affecting** (`inet` ⇄ `text`), so it shows up as an `ALTER` on the next `meta migrate`.
+
+```json
+{ "field.uri":  { "name": "homepage" } }                       // strict — must be an absolute URL
+{ "field.uri":  { "name": "citationUrl", "@lenient": true } }  // any string (LLM-emitted, may be malformed)
+{ "field.inet": { "name": "sourceIp" } }                       // strict — IPv4/IPv6 literal only
+{ "field.inet": { "name": "reportedHost", "@lenient": true } } // any string; text column
+```
+
 **`@autoSet` — let the runtime stamp created/updated times; never hand-set them.**
 `@autoSet` is registered on the temporal subtypes (`field.date` / `field.time` /
 `field.timestamp`) and takes **`onCreate`** (stamp on insert) or **`onUpdate`**

fixtures/agent-context-conformance/java-react/expected/.claude/skills/metaobjects-authoring/SKILL.md

@@ -313,8 +313,8 @@ Canonical form for common field needs — reach for these before inventing anyth
 | Long / unbounded text | bare `field.string` | add `@maxLength` only when you want `varchar(N)` |
 | Nested structured value | `field.object` | `@objectRef` + `@storage` |
 | Open JSON bag (no fixed shape) | `field.string` + `@dbColumnType: jsonb` | logical type stays string; column is jsonb |
-| URL / URI | `field.uri` | native `URI`/`Uri`; `text` column; URL validation — a real native type + behavior, so a subtype (not a validated string) |
-| IP address | `field.inet` | native IP type; Postgres `inet` column |
+| URL / URI | `field.uri` | native `URI`/`Uri`; `text` column; strict absolute-URI validation (add `@lenient: true` to store any string) — a real native type + behavior, so a subtype (not a validated string) |
+| IP address | `field.inet` | native IP type; Postgres `inet` column; strict IPv4/IPv6-literal validation (add `@lenient: true` for a plain-string `text` column) |
 | Validated plain string (email / hostname) | `field.string` + `@stringFormat` | `@stringFormat: email` or `@stringFormat: hostname` — idiomatic per-port validation; don't hand-write the `validator.regex` |
 
 **UUID columns are `field.uuid` — `field.string` + `@dbColumnType: uuid` is a forbidden smell.**
@@ -352,6 +352,24 @@ lives in `field.timestamp` (instant by default) + the `@localTime` naive opt-out
 { "field.timestamp": { "name": "opensAt", "@localTime": true } }
 ```
 
+**URIs / IPs — strict by default, `@lenient` to store any string (#234).** `field.uri` is a
+strict **absolute, scheme-bearing URI** (`https://a.com`, `mailto:a@b`; a scheme-less
+`example.com` or a bare `/path` is rejected) and `field.inet` is a strict **IPv4/IPv6 literal**
+(no hostnames, no CIDR). When a field must hold a *not-necessarily-well-formed* value — an
+LLM-emitted citation URL, a user-supplied host that might be a name — add **`@lenient: true`**:
+codegen then binds a plain string (no URL/IP validator) and a `field.inet @lenient` uses a plain
+`text` column instead of the native `inet` type (so a value the native column would reject at
+INSERT round-trips unchanged). Strict is the default; `@lenient` is the deliberate opt-out (never
+default-true — the same shape as `@localTime`). **Toggling `@lenient` on an existing `field.inet`
+is schema-affecting** (`inet` ⇄ `text`), so it shows up as an `ALTER` on the next `meta migrate`.
+
+```json
+{ "field.uri":  { "name": "homepage" } }                       // strict — must be an absolute URL
+{ "field.uri":  { "name": "citationUrl", "@lenient": true } }  // any string (LLM-emitted, may be malformed)
+{ "field.inet": { "name": "sourceIp" } }                       // strict — IPv4/IPv6 literal only
+{ "field.inet": { "name": "reportedHost", "@lenient": true } } // any string; text column
+```
+
 **`@autoSet` — let the runtime stamp created/updated times; never hand-set them.**
 `@autoSet` is registered on the temporal subtypes (`field.date` / `field.time` /
 `field.timestamp`) and takes **`onCreate`** (stamp on insert) or **`onUpdate`**

fixtures/agent-context-conformance/python/expected/.claude/skills/metaobjects-authoring/SKILL.md

@@ -313,8 +313,8 @@ Canonical form for common field needs — reach for these before inventing anyth
 | Long / unbounded text | bare `field.string` | add `@maxLength` only when you want `varchar(N)` |
 | Nested structured value | `field.object` | `@objectRef` + `@storage` |
 | Open JSON bag (no fixed shape) | `field.string` + `@dbColumnType: jsonb` | logical type stays string; column is jsonb |
-| URL / URI | `field.uri` | native `URI`/`Uri`; `text` column; URL validation — a real native type + behavior, so a subtype (not a validated string) |
-| IP address | `field.inet` | native IP type; Postgres `inet` column |
+| URL / URI | `field.uri` | native `URI`/`Uri`; `text` column; strict absolute-URI validation (add `@lenient: true` to store any string) — a real native type + behavior, so a subtype (not a validated string) |
+| IP address | `field.inet` | native IP type; Postgres `inet` column; strict IPv4/IPv6-literal validation (add `@lenient: true` for a plain-string `text` column) |
 | Validated plain string (email / hostname) | `field.string` + `@stringFormat` | `@stringFormat: email` or `@stringFormat: hostname` — idiomatic per-port validation; don't hand-write the `validator.regex` |
 
 **UUID columns are `field.uuid` — `field.string` + `@dbColumnType: uuid` is a forbidden smell.**
@@ -352,6 +352,24 @@ lives in `field.timestamp` (instant by default) + the `@localTime` naive opt-out
 { "field.timestamp": { "name": "opensAt", "@localTime": true } }
 ```
 
+**URIs / IPs — strict by default, `@lenient` to store any string (#234).** `field.uri` is a
+strict **absolute, scheme-bearing URI** (`https://a.com`, `mailto:a@b`; a scheme-less
+`example.com` or a bare `/path` is rejected) and `field.inet` is a strict **IPv4/IPv6 literal**
+(no hostnames, no CIDR). When a field must hold a *not-necessarily-well-formed* value — an
+LLM-emitted citation URL, a user-supplied host that might be a name — add **`@lenient: true`**:
+codegen then binds a plain string (no URL/IP validator) and a `field.inet @lenient` uses a plain
+`text` column instead of the native `inet` type (so a value the native column would reject at
+INSERT round-trips unchanged). Strict is the default; `@lenient` is the deliberate opt-out (never
+default-true — the same shape as `@localTime`). **Toggling `@lenient` on an existing `field.inet`
+is schema-affecting** (`inet` ⇄ `text`), so it shows up as an `ALTER` on the next `meta migrate`.
+
+```json
+{ "field.uri":  { "name": "homepage" } }                       // strict — must be an absolute URL
+{ "field.uri":  { "name": "citationUrl", "@lenient": true } }  // any string (LLM-emitted, may be malformed)
+{ "field.inet": { "name": "sourceIp" } }                       // strict — IPv4/IPv6 literal only
+{ "field.inet": { "name": "reportedHost", "@lenient": true } } // any string; text column
+```
+
 **`@autoSet` — let the runtime stamp created/updated times; never hand-set them.**
 `@autoSet` is registered on the temporal subtypes (`field.date` / `field.time` /
 `field.timestamp`) and takes **`onCreate`** (stamp on insert) or **`onUpdate`**

fixtures/agent-context-conformance/ts-react-tanstack/expected/.claude/skills/metaobjects-authoring/SKILL.md

@@ -313,8 +313,8 @@ Canonical form for common field needs — reach for these before inventing anyth
 | Long / unbounded text | bare `field.string` | add `@maxLength` only when you want `varchar(N)` |
 | Nested structured value | `field.object` | `@objectRef` + `@storage` |
 | Open JSON bag (no fixed shape) | `field.string` + `@dbColumnType: jsonb` | logical type stays string; column is jsonb |
-| URL / URI | `field.uri` | native `URI`/`Uri`; `text` column; URL validation — a real native type + behavior, so a subtype (not a validated string) |
-| IP address | `field.inet` | native IP type; Postgres `inet` column |
+| URL / URI | `field.uri` | native `URI`/`Uri`; `text` column; strict absolute-URI validation (add `@lenient: true` to store any string) — a real native type + behavior, so a subtype (not a validated string) |
+| IP address | `field.inet` | native IP type; Postgres `inet` column; strict IPv4/IPv6-literal validation (add `@lenient: true` for a plain-string `text` column) |
 | Validated plain string (email / hostname) | `field.string` + `@stringFormat` | `@stringFormat: email` or `@stringFormat: hostname` — idiomatic per-port validation; don't hand-write the `validator.regex` |
 
 **UUID columns are `field.uuid` — `field.string` + `@dbColumnType: uuid` is a forbidden smell.**
@@ -352,6 +352,24 @@ lives in `field.timestamp` (instant by default) + the `@localTime` naive opt-out
 { "field.timestamp": { "name": "opensAt", "@localTime": true } }
 ```
 
+**URIs / IPs — strict by default, `@lenient` to store any string (#234).** `field.uri` is a
+strict **absolute, scheme-bearing URI** (`https://a.com`, `mailto:a@b`; a scheme-less
+`example.com` or a bare `/path` is rejected) and `field.inet` is a strict **IPv4/IPv6 literal**
+(no hostnames, no CIDR). When a field must hold a *not-necessarily-well-formed* value — an
+LLM-emitted citation URL, a user-supplied host that might be a name — add **`@lenient: true`**:
+codegen then binds a plain string (no URL/IP validator) and a `field.inet @lenient` uses a plain
+`text` column instead of the native `inet` type (so a value the native column would reject at
+INSERT round-trips unchanged). Strict is the default; `@lenient` is the deliberate opt-out (never
+default-true — the same shape as `@localTime`). **Toggling `@lenient` on an existing `field.inet`
+is schema-affecting** (`inet` ⇄ `text`), so it shows up as an `ALTER` on the next `meta migrate`.
+
+```json
+{ "field.uri":  { "name": "homepage" } }                       // strict — must be an absolute URL
+{ "field.uri":  { "name": "citationUrl", "@lenient": true } }  // any string (LLM-emitted, may be malformed)
+{ "field.inet": { "name": "sourceIp" } }                       // strict — IPv4/IPv6 literal only
+{ "field.inet": { "name": "reportedHost", "@lenient": true } } // any string; text column
+```
+
 **`@autoSet` — let the runtime stamp created/updated times; never hand-set them.**
 `@autoSet` is registered on the temporal subtypes (`field.date` / `field.time` /
 `field.timestamp`) and takes **`onCreate`** (stamp on insert) or **`onUpdate`**

fixtures/conformance/field-uri-inet-stringformat/expected.json

@@ -33,6 +33,18 @@
                 "@stringFormat": "hostname"
               }
             },
+            {
+              "field.uri": {
+                "name": "citationUrl",
+                "@lenient": true
+              }
+            },
+            {
+              "field.inet": {
+                "name": "reportedIp",
+                "@lenient": true
+              }
+            },
             {
               "identity.primary": {
                 "name": "id",

fixtures/conformance/field-uri-inet-stringformat/input/meta.contact.json

@@ -33,6 +33,18 @@
                 "@stringFormat": "hostname"
               }
             },
+            {
+              "field.uri": {
+                "name": "citationUrl",
+                "@lenient": true
+              }
+            },
+            {
+              "field.inet": {
+                "name": "reportedIp",
+                "@lenient": true
+              }
+            },
             {
               "identity.primary": {
                 "name": "id",