chtypes 2.0.0.dev3__tar.gz → 2.0.0.dev5__tar.gz

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev5}/CHANGELOG.md

@@ -8,8 +8,41 @@ The four bindings in this repository are released together and give one answer,
 
 ### Added
 
+- Every settings layer's filter-declined settings, in one list (ABI v2; moves the dev fingerprint; #588): `SchemaDescription.filter_declined_settings`, a tuple of `DeclinedSetting`, decoded from `schema_description`'s new required top-level `filter_declined_settings`, over every layer known at schema compile (`setup`'s defaults as the compile captured them, the server profile, and the schema's own settings). `DeclinedSetting` gains `layer`, the highest layer that sets the name, from the new `DeclinedLayer` vocabulary (`DEFAULTS`, `SERVER`, `SCHEMA`, and its unknown(n)). One entry per name, ordered by layer and then by name bytes, as the library writes it; the binding sorts nothing.
+- `Schema.describe` raises the library's `CHS_REJECTED` with ch_code 306 (TOO_DEEP_RECURSION), a `SchemaError`, for a deep input the server's stack check refuses (ABI v2: `chs_schema_describe` now lists `CHS_REJECTED`).
+- The server's filter-declined settings (ABI v2; moves the dev fingerprint): `SchemaServer.filter_declined_settings`, a tuple of `DeclinedSetting` (`name`, `tier`), decoded from `schema_description`'s new required `server.filter_declined_settings`, with the new `DeclinedTier` vocabulary (`PREDICATE`, `PREDICATE_UNFLIPPED`, `RESULT_CONTENT`, and its unknown(n)). `compile_filter` on a schema whose server lists any is the library's `CHS_DECLINED`, an `UnsupportedError` carrying its message; a filter's own settings other than `session_timezone` are no longer declined at compile, and a declined one is named at evaluation instead.
+- The v2 spec states that a filter verdict counts only when the evaluation's outcome is `ok`: over a body a server would not accept, every verdict is `d`.
+- The v2 spec publishes the WHERE-affecting settings lists (`spec/abi-v2/where-settings/`) with the consumer rule.
+- The v2 spec publishes the filter decline-reasons catalog (`spec/abi-v2/declines/`).
+- The v2 spec's decline catalog has 49 entries, and it publishes the settings values a server refuses outright (`spec/abi-v2/where-settings/documented-pathological.tsv`).
+- The v2 spec's decline catalog follows the producer's batch 11: its `server-profile-setting` entry now covers every settings layer the schema compiles under (the id is unchanged), the evaluation-time setting entries name only the filter's own settings, and its `stack-depth` entry lists `chs_schema_describe`.
+- A `410 Gone` is a retired repository, and permanent (#571). Any request the fetch layer makes (a tag, an alias, a digest, a blob, `tags/list`, the referrers API or its fallback tag, after a redirect too) that answers `410` is now the new code `CHTYPES_SOURCE_RETIRED` (exit status 10), never retried and never sent to the next base, nor from the dev channel's alias to its tag. It was `CHTYPES_SOURCE_UNREACHABLE` (exit 3) with the registry's message dropped, and Go, Python and Rust moved on to the next base, so a mirror's 404 could hide the retirement. The error names the URL that answered and carries the registry's own message, with control and bidirectional-formatting characters removed and cut to 256 code points: Go `CodeSourceRetired` (`errors.Is(err, ErrSourceRetired)`), Python and TypeScript `SourceRetiredError`, Rust `Error::SourceRetired`. The rule is `docs/guides/fetch-v1.md` section 2, "A retired repository", and the `retired-410-*` and `list-tags-retired-410` conformance cases and one shared message table (`tests/fixtures/retired-message/cases.json`) hold all four bindings to it.
 - A 2.0.0-dev SDK prefers the newest build of its own fingerprint (#511). A version request resolves `<tag>--fp-<fingerprint>` first, the alias the staging dev registry serves beside every dev tag, with the binding's own generated ABI fingerprint, and the tag itself only when every base answers the alias 404; any other failure of the alias request is that failure, with no fallback, and an alias whose index lacks the platform is `CHTYPES_ARTIFACT_UNPUBLISHED`. The dev channel's cache lookups (the installed-build lookup a registry open makes first, the offline answer, and the monotonic rule of a fetch) now see only records whose signed `abi_fingerprint` is the SDK's own, so a newer build of another fingerprint, installed by another dev SDK in the shared cache, is never returned or kept over this one's own, and is never removed or rewritten. So a dev build of a newer fingerprint no longer strands an older dev SDK until its consumers upgrade. Trust is unchanged (the signed predicate and the load checks decide), a listing never shows an alias, nothing records one, `list` and `where` are unchanged, and there is no option: both steps are the dev channel's alone, and the v1 contract and every production channel never take them. The rule is `docs/guides/fetch-v1.md` section 3, and the `dev-alias-*`, `resolve-installed-dev-alias-*` and `list-tags-dev-alias` conformance cases hold all four bindings to it.
 
+### Changed
+
+- `compile_filter` is the library's `CHS_DECLINED`, `UnsupportedError`, on a schema whose `filter_declined_settings` is not empty from any layer, and its message names each setting and its layer (ABI v2, #588). A declined setting from the defaults or the schema's own settings now fails the compile, where it was named at evaluation before; a filter's own settings and an evaluation's are still named at evaluation.
+- **Enforcement gate lifted** for `26.3` on `linux-amd64`.
+- **Enforcement gate lifted** for `26.7` on `linux-amd64`.
+- **Enforcement gate lifted** for `26.8` on `linux-amd64`.
+- **Enforcement gate lifted** for `26.9` on `linux-amd64`.
+- **Enforcement gate lifted** for `26.3` on `linux-arm64`.
+- **Enforcement gate lifted** for `26.7` on `linux-arm64`.
+- **Enforcement gate lifted** for `26.8` on `linux-arm64`.
+- **Enforcement gate lifted** for `26.9` on `linux-arm64`.
+- **Enforcement gate lifted** for `26.7` on `darwin-arm64`.
+- **Enforcement gate lifted** for `26.8` on `darwin-arm64`.
+- **Enforcement gate lifted** for `26.9` on `darwin-arm64`.
+
+### Removed
+
+- `SchemaServer.filter_declined_settings` (a breaking change inside v2 dev, #588): the server member no longer carries the list. Read `SchemaDescription.filter_declined_settings`, whose `server`-layer entries are the profile's.
+
+### Fixed
+
+- A 2.0.0-dev SDK whose own-fingerprint alias has expired, with a cached build of that fingerprint for the request, now says so in the `CHTYPES_ARTIFACT_UNPUBLISHED` message of `fetch` (#581): `; a cached build for this fingerprint (build <id>) is still usable by open; upgrade the SDK to get newer builds` is appended. The code, the exit status (4) and the cache are unchanged, and all four bindings give the same message (`fp-ahead-cached-own-fp`).
+- A 2.0.0-dev SDK whose fingerprint no published build carries yet now fails closed with a precise message (#578). When every base answers its own alias 404 and the tag names a build signed for another fingerprint, `fetch` is `CHTYPES_ARTIFACT_UNPUBLISHED` (exit status 4): `no published build for this SDK's fingerprint <own fp>; newest published on this channel is <fp> (build <id>)`. It used to install that build, or report it already installed, and the lookup at open then answered `CHTYPES_ARTIFACT_MISSING` with advice to run `fetch`: a loop with no pointer to the cause. Nothing is downloaded or installed and the cache is unchanged. An alias that answers, a tag at the SDK's own fingerprint and the v1 contract are unchanged. All four bindings run the same fetch conformance cases, `fp-ahead-*`, and the rule is `docs/guides/fetch-v1.md` section 3.
+
 ## [1.1.0] — 2026-10-06
 
 ### Added

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: chtypes
-Version: 2.0.0.dev3
+Version: 2.0.0.dev5
 Summary: Python binding for the chtypes artifacts: ClickHouse's own type system, per version, behind the frozen chs_* C ABI
 Project-URL: Homepage, https://github.com/wave-rf/chtypes
 Project-URL: Repository, https://github.com/wave-rf/chtypes
@@ -22,6 +22,8 @@ Description-Content-Type: text/markdown
 > **2.0.0-dev: UNSTABLE, staging only, not for production.** This is the ABI v2 development binding (public issue #511). It speaks ABI v2's unstable description, pins its dev fingerprint and refuses a library with any other ("update your dev SDK"). It fetches only from the staging dev channel (`https://registry-staging.wavehouse.dev/chtypes/v2-dev`) and trusts only the staging key; `CHTYPES_ARTIFACTS_URL`, `CHTYPES_TRUSTED_KEYS` and `CHTYPES_ALLOW_UNSIGNED`, and the `bases`, `trusted_keys` and `allow_unsigned` fetch options, are ignored, each with one warning; `--lock`, `--frozen` and `--update`, and the `frozen`, `lock_path`, `lock_write` and `update` options, are refused, because a dev build is replaceable and a superseded one expires after 14 days. Its cache is `${XDG_CACHE_HOME:-~/.cache}/chtypes/v2-dev`, or `<CHTYPES_CACHE>/v2-dev` under an explicit cache, which no 1.x SDK reads. A dev SDK prefers the newest build of its own fingerprint: it resolves `<tag>--fp-<its fingerprint>` first and the tag only when no such build exists, and its cache lookups ignore another dev SDK's builds in a shared cache, so a newer dev fingerprint never strands it (§3 of [`docs/guides/fetch-v1.md`](../docs/guides/fetch-v1.md)). Every vocabulary keeps a value it does not list as its `unknown(n)` member (`Outcome("x")`, whose `known` is `False`) instead of failing the document. The rules are r1 to r6 of [`docs/reference/abi-v2.md`](../docs/reference/abi-v2.md). For production, use the 1.x package: `pip install "chtypes<2"`.
 >
 > An explicit cache directory gets the `v2-dev` subroot whether it comes from `CHTYPES_CACHE` or from `FetchOptions(cache_dir=...)`: the layout is under `<cache_dir>/v2-dev`, never in the directory itself, so code that inspects or pre-populates a cache looks there; `chtypes.cache_root` and `chtypes.search_dirs` return the resolved paths. `CHTYPES_OFFLINE=1` is the environment twin of `FetchOptions(offline=True)` and `--offline`: the cache only, no request.
+>
+> <!-- remove-at-v2-lock -->v2-dev builds before the one that carries this contract (its release notice names it) can answer `ok` with `t` verdicts after a refused row. On those builds, when a body or block holds more than one row, treat every verdict as `d` if `errors` is non-empty.<!-- /remove-at-v2-lock -->
 
 **If this row were inserted into this table on this ClickHouse version, what would happen?** chtypes answers with ClickHouse's own code: the real C++ type machinery, vendored per release into a native library behind the frozen `chs_*` C ABI and reached here through stdlib `ctypes`. Nothing semantic is reimplemented, so _"what does ClickHouse do with `256` into a `UInt8`?"_ is answered by ClickHouse rather than by a model of it. One peer binding among `{go, python, ts, rust}` — no language is privileged, and all four give one answer.
 

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev5}/README.md

@@ -3,6 +3,8 @@
 > **2.0.0-dev: UNSTABLE, staging only, not for production.** This is the ABI v2 development binding (public issue #511). It speaks ABI v2's unstable description, pins its dev fingerprint and refuses a library with any other ("update your dev SDK"). It fetches only from the staging dev channel (`https://registry-staging.wavehouse.dev/chtypes/v2-dev`) and trusts only the staging key; `CHTYPES_ARTIFACTS_URL`, `CHTYPES_TRUSTED_KEYS` and `CHTYPES_ALLOW_UNSIGNED`, and the `bases`, `trusted_keys` and `allow_unsigned` fetch options, are ignored, each with one warning; `--lock`, `--frozen` and `--update`, and the `frozen`, `lock_path`, `lock_write` and `update` options, are refused, because a dev build is replaceable and a superseded one expires after 14 days. Its cache is `${XDG_CACHE_HOME:-~/.cache}/chtypes/v2-dev`, or `<CHTYPES_CACHE>/v2-dev` under an explicit cache, which no 1.x SDK reads. A dev SDK prefers the newest build of its own fingerprint: it resolves `<tag>--fp-<its fingerprint>` first and the tag only when no such build exists, and its cache lookups ignore another dev SDK's builds in a shared cache, so a newer dev fingerprint never strands it (§3 of [`docs/guides/fetch-v1.md`](../docs/guides/fetch-v1.md)). Every vocabulary keeps a value it does not list as its `unknown(n)` member (`Outcome("x")`, whose `known` is `False`) instead of failing the document. The rules are r1 to r6 of [`docs/reference/abi-v2.md`](../docs/reference/abi-v2.md). For production, use the 1.x package: `pip install "chtypes<2"`.
 >
 > An explicit cache directory gets the `v2-dev` subroot whether it comes from `CHTYPES_CACHE` or from `FetchOptions(cache_dir=...)`: the layout is under `<cache_dir>/v2-dev`, never in the directory itself, so code that inspects or pre-populates a cache looks there; `chtypes.cache_root` and `chtypes.search_dirs` return the resolved paths. `CHTYPES_OFFLINE=1` is the environment twin of `FetchOptions(offline=True)` and `--offline`: the cache only, no request.
+>
+> <!-- remove-at-v2-lock -->v2-dev builds before the one that carries this contract (its release notice names it) can answer `ok` with `t` verdicts after a refused row. On those builds, when a body or block holds more than one row, treat every verdict as `d` if `errors` is non-empty.<!-- /remove-at-v2-lock -->
 
 **If this row were inserted into this table on this ClickHouse version, what would happen?** chtypes answers with ClickHouse's own code: the real C++ type machinery, vendored per release into a native library behind the frozen `chs_*` C ABI and reached here through stdlib `ctypes`. Nothing semantic is reimplemented, so _"what does ClickHouse do with `256` into a `UInt8`?"_ is answered by ClickHouse rather than by a model of it. One peer binding among `{go, python, ts, rust}` — no language is privileged, and all four give one answer.
 

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "chtypes"
-version = "2.0.0.dev3"
+version = "2.0.0.dev5"
 description = "Python binding for the chtypes artifacts: ClickHouse's own type system, per version, behind the frozen chs_* C ABI"
 readme = "README.md"
 license = "Apache-2.0"

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev5}/src/chtypes/__init__.py

@@ -48,6 +48,8 @@ from importlib.metadata import version as _package_version
 
 from ._abi2._vocab import (
     EXPORT_NONE,
+    DeclinedLayer,
+    DeclinedTier,
     DefaultKind,
     DiscoverQueryParam,
     DocFlags,
@@ -72,6 +74,7 @@ from .errors import (
     CODE_CACHE_UNUSABLE,
     CODE_SOURCE_FORBIDDEN,
     CODE_SOURCE_INCOMPATIBLE,
+    CODE_SOURCE_RETIRED,
     CODE_SOURCE_UNAUTHORIZED,
     CODE_SOURCE_UNREACHABLE,
     ArtifactCorruptError,
@@ -88,6 +91,7 @@ from .errors import (
     SchemaError,
     SourceForbiddenError,
     SourceIncompatibleError,
+    SourceRetiredError,
     SourceUnauthorizedError,
     SourceUnreachableError,
     UnsupportedError,
@@ -102,6 +106,7 @@ from .results import (
     Capabilities,
     Column,
     Computed,
+    DeclinedSetting,
     DiscoveredColumn,
     Discovery,
     EngineCell,
@@ -130,6 +135,7 @@ __all__ = [
     "CODE_CACHE_UNUSABLE",
     "CODE_SOURCE_FORBIDDEN",
     "CODE_SOURCE_INCOMPATIBLE",
+    "CODE_SOURCE_RETIRED",
     "CODE_SOURCE_UNAUTHORIZED",
     "CODE_SOURCE_UNREACHABLE",
     "EXPORT_NONE",
@@ -151,6 +157,9 @@ __all__ = [
     "ChtypesError",
     "Column",
     "Computed",
+    "DeclinedLayer",
+    "DeclinedSetting",
+    "DeclinedTier",
     "DefaultKind",
     "DiscoverQueryParam",
     "DiscoveredColumn",
@@ -186,6 +195,7 @@ __all__ = [
     "Source",
     "SourceForbiddenError",
     "SourceIncompatibleError",
+    "SourceRetiredError",
     "SourceUnauthorizedError",
     "SourceUnreachableError",
     "Span",

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev5}/src/chtypes/_abi2/_decls.py

@@ -1,4 +1,4 @@
-# GENERATED by scripts/abi-v1/gen.py --major 2 from spec/abi-v2/abi.json (CHS_ABI_FINGERPRINT sha256:4129dccc3f4e698dedb0e99cae413f5240085f633c5a1244e2c55bf7a7bb6c3a) — DO NOT EDIT  # noqa: E501
+# GENERATED by scripts/abi-v1/gen.py --major 2 from spec/abi-v2/abi.json (CHS_ABI_FINGERPRINT sha256:d60a681ea0e249ab9e2c83b50640ad9cef040261ddf61805106c93e2c68774e4) — DO NOT EDIT  # noqa: E501
 """The Python binding's generated ABI v2 layer: ctypes signatures, the handle
 classes, the two-phase resolve functions and invoke_by_name(), the test-only
 dispatcher the conformance suite drives from tests/fixtures/abi-v2/cases.json.
@@ -19,7 +19,7 @@ from dataclasses import dataclass, field
 from . import _errmap
 
 CHS_ABI_VERSION = 2
-CHS_ABI_FINGERPRINT = "sha256:4129dccc3f4e698dedb0e99cae413f5240085f633c5a1244e2c55bf7a7bb6c3a"
+CHS_ABI_FINGERPRINT = "sha256:d60a681ea0e249ab9e2c83b50640ad9cef040261ddf61805106c93e2c68774e4"
 
 # The description's stability: "unstable" while this generation is being
 # designed, so CHS_ABI_FINGERPRINT moves with every change, and "locked" after

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev5}/src/chtypes/_abi2/_errmap.py

@@ -1,4 +1,4 @@
-# GENERATED by scripts/abi-v1/gen.py --major 2 from spec/abi-v2/abi.json (CHS_ABI_FINGERPRINT sha256:4129dccc3f4e698dedb0e99cae413f5240085f633c5a1244e2c55bf7a7bb6c3a) — DO NOT EDIT  # noqa: E501
+# GENERATED by scripts/abi-v1/gen.py --major 2 from spec/abi-v2/abi.json (CHS_ABI_FINGERPRINT sha256:d60a681ea0e249ab9e2c83b50640ad9cef040261ddf61805106c93e2c68774e4) — DO NOT EDIT  # noqa: E501
 """spec/abi-v2/sdk.json's error-mapping tables, as references to the
 public classes (python/src/chtypes/errors.py, re-exported by
 python/src/chtypes/_abi2/_errors.py). Only the MAPPING is generated: the

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev5}/src/chtypes/_abi2/_vocab.py

@@ -1,10 +1,10 @@
-# GENERATED by scripts/abi-v1/gen.py --major 2 from spec/abi-v2/abi.json (CHS_ABI_FINGERPRINT sha256:4129dccc3f4e698dedb0e99cae413f5240085f633c5a1244e2c55bf7a7bb6c3a) — DO NOT EDIT  # noqa: E501
+# GENERATED by scripts/abi-v1/gen.py --major 2 from spec/abi-v2/abi.json (CHS_ABI_FINGERPRINT sha256:d60a681ea0e249ab9e2c83b50640ad9cef040261ddf61805106c93e2c68774e4) — DO NOT EDIT  # noqa: E501
 """The Python binding's generated vocabularies, from spec/abi-v2/abi.json: the C
 enums (`Format`, `Status`), the document vocabularies (`Outcome`, `FilterOutcome`,
-`Verdict`, `DefaultKind`, `MergeReason`, `Reason`, `Source`, `DiscoverQueryParam`) with the
-facts the description attaches to each value (`Format.ch_name`, `Reason` lossy,
-`Source` is_stored, `Verdict.answered`), and the `DocFlags` groups. No other file in
-this package keeps a copy of any of it.
+`Verdict`, `DefaultKind`, `MergeReason`, `DeclinedTier`, `DeclinedLayer`, `Reason`,
+`Source`, `DiscoverQueryParam`) with the facts the description attaches to each value
+(`Format.ch_name`, `Reason` lossy, `Source` is_stored, `Verdict.answered`), and the
+`DocFlags` groups. No other file in this package keeps a copy of any of it.
 
 Rule r3 (spec/abi-v2/docs.md): every vocabulary has an unknown(n) member, and a
 value the description does not list reads as it, carrying the raw value, for that
@@ -249,6 +249,56 @@ class MergeReason(StrEnum):
         return cls(text)
 
 
+class DeclinedTier(StrEnum):
+    """The WHERE-settings tier of a setting a settings layer sets and this build's
+    filters do not honor in a WHERE, as a `DeclinedSetting` reports it."""
+
+    PREDICATE = "predicate"
+    PREDICATE_UNFLIPPED = "predicate-unflipped"
+    RESULT_CONTENT = "result-content"
+
+    @classmethod
+    def _missing_(cls, value: object) -> DeclinedTier | None:
+        return _unknown_str(cls, value)
+
+    @property
+    def known(self) -> bool:
+        """Whether the description lists this value: False for exactly the unknown(n)
+        member an unlisted value reads as (rule r3)."""
+        return type(self)._value2member_map_.get(self._value_) is self
+
+    @classmethod
+    def of(cls, text: str) -> DeclinedTier:
+        """Map a document's spelling. One the description does not list is kept as
+        this vocabulary's unknown(n) member, carrying it (rule r3)."""
+        return cls(text)
+
+
+class DeclinedLayer(StrEnum):
+    """The settings layer a `DeclinedSetting` comes from, the highest one that sets
+    the name: `defaults`, `server` or `schema`, lowest first."""
+
+    DEFAULTS = "defaults"
+    SERVER = "server"
+    SCHEMA = "schema"
+
+    @classmethod
+    def _missing_(cls, value: object) -> DeclinedLayer | None:
+        return _unknown_str(cls, value)
+
+    @property
+    def known(self) -> bool:
+        """Whether the description lists this value: False for exactly the unknown(n)
+        member an unlisted value reads as (rule r3)."""
+        return type(self)._value2member_map_.get(self._value_) is self
+
+    @classmethod
+    def of(cls, text: str) -> DeclinedLayer:
+        """Map a document's spelling. One the description does not list is kept as
+        this vocabulary's unknown(n) member, carrying it (rule r3)."""
+        return cls(text)
+
+
 class DiscoverQueryParam(StrEnum):
     """A query parameter of the SQL `discover_query` returns, which the caller binds
     when it runs the query."""
@@ -415,6 +465,8 @@ DESCRIBED_VOCABULARIES: Final[dict[str, type]] = {
     "filter_verdict": Verdict,
     "discover_query_param": DiscoverQueryParam,
     "default_kind": DefaultKind,
+    "declined_tier": DeclinedTier,
+    "declined_layer": DeclinedLayer,
 }
 
 

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev5}/src/chtypes/_decode.py

@@ -28,7 +28,17 @@ import json
 from collections.abc import Callable, Mapping
 from typing import Any
 
-from ._abi2._vocab import DefaultKind, FilterOutcome, MergeReason, Outcome, Reason, Source, Verdict
+from ._abi2._vocab import (
+    DeclinedLayer,
+    DeclinedTier,
+    DefaultKind,
+    FilterOutcome,
+    MergeReason,
+    Outcome,
+    Reason,
+    Source,
+    Verdict,
+)
 from .errors import ArtifactCorruptError, internal
 from .results import (
     AtMergeEntry,
@@ -37,6 +47,7 @@ from .results import (
     Capabilities,
     Column,
     Computed,
+    DeclinedSetting,
     DiscoveredColumn,
     Discovery,
     EngineCell,
@@ -493,6 +504,15 @@ def _string_map(obj: Mapping[str, Any], key: str, where: str) -> dict[str, str]
     return out
 
 
+def _declined_setting(obj: dict[str, Any], where: str) -> DeclinedSetting:
+    # An unlisted tier or layer is its unknown(n): kept, never a failure (rule r3).
+    return DeclinedSetting(
+        name=_name(obj, "name", where),
+        tier=DeclinedTier.of(_text(obj, "tier", where)),
+        layer=DeclinedLayer.of(_text(obj, "layer", where)),
+    )
+
+
 def _server(obj: dict[str, Any], where: str) -> SchemaServer:
     return SchemaServer(
         timezone=_text(obj, "timezone", where),
@@ -525,6 +545,10 @@ def decode_schema_description(raw: bytes) -> SchemaDescription:
             if replicated is None
             else _replicated(_obj(replicated, where, "replicated"), f"{where}.replicated")
         ),
+        # Over every layer known at schema compile, with or without a server.
+        filter_declined_settings=_objects(
+            obj, "filter_declined_settings", where, _declined_setting
+        ),
     )
 
 

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev5}/src/chtypes/_ocifetch/_channel.py

@@ -52,6 +52,7 @@ from typing import Final, Protocol
 from chtypes._abi2._decls import CHS_ABI_FINGERPRINT
 from chtypes._ocifetch import _constants as C
 from chtypes._ocifetch._dsse import TrustedKey
+from chtypes._ocifetch._errors import ArtifactUnpublishedError
 
 __all__ = [
     "ALIAS_SEPARATOR",
@@ -66,6 +67,7 @@ __all__ = [
     "PinningRefusedError",
     "abi",
     "active",
+    "ahead_of_registry",
     "alias_tag",
     "allow_overrides_for_tests",
     "channel_name",
@@ -274,6 +276,69 @@ def visible(predicate: object, channel: Channel | None = None) -> bool:
     return fingerprint == f"sha256:{channel.own_fingerprint}"
 
 
+def ahead_of_registry(
+    alias_absent: bool,
+    predicate: object,
+    channel: Channel | None = None,
+    *,
+    cached_own_build: Callable[[], str | None] | None = None,
+) -> None:
+    """The dev channel's answer for an SDK whose fingerprint no published build
+    carries yet (docs/guides/fetch-v1.md §3; public issue #578): when every base
+    answered its own alias 404 (`alias_absent`) and the build the tag names is
+    signed for another fingerprint (`predicate`, the SIGNED predicate, the field
+    `visible` keys on), raise `ArtifactUnpublishedError`, the code a request no
+    build answers gets, naming both fingerprints. Nothing is installed and an
+    install of that build is never reported, because the lookup this SDK opens
+    through would refuse it. Returns in every other case: the alias answered,
+    the tag's build is this SDK's own, or the contract has no own fingerprint.
+
+    The expired alias with a usable cache (public issue #581): `cached_own_build`
+    looks up, through the filter open uses, the cache's verified record of this
+    SDK's OWN fingerprint for the request, and returns its build id ("" for a
+    record that names none) or None for no record. When there is one the
+    message grows by `_cached_own_suffix`; the code does not change."""
+    channel = channel or active()
+    if not alias_absent or visible(predicate, channel):
+        return
+    message = _ahead_message(channel.own_fingerprint, predicate)
+    if cached_own_build is not None:
+        build = cached_own_build()
+        if build is not None:
+            message += _cached_own_suffix(build)
+    raise ArtifactUnpublishedError(f"chtypes: {message}")
+
+
+def _cached_own_suffix(build: str) -> str:
+    """The clause appended when the cache holds an own-fingerprint build: "; a
+    cached build for this fingerprint (build <id>) is still usable by open;
+    upgrade the SDK to get newer builds", the parenthesis dropped when the
+    record names no build."""
+    suffix = "; a cached build for this fingerprint"
+    if build:
+        suffix += f" (build {build})"
+    return suffix + " is still usable by open; upgrade the SDK to get newer builds"
+
+
+def _ahead_message(own: str, predicate: object) -> str:
+    """`ahead_of_registry`'s message: "no published build for this SDK's
+    fingerprint <own>; newest published on this channel is <fp> (build <id>)",
+    each fingerprint 64 lowercase hex without its `sha256:` prefix, the
+    parenthesis dropped when the predicate names no build, and "unnamed" for a
+    predicate that names no fingerprint."""
+    fields = predicate if isinstance(predicate, dict) else {}
+    theirs = fields.get("abi_fingerprint")
+    theirs = theirs.removeprefix("sha256:") if isinstance(theirs, str) else ""
+    message = (
+        f"no published build for this SDK's fingerprint {own}; "
+        f"newest published on this channel is {theirs or 'unnamed'}"
+    )
+    build = fields.get("build")
+    if isinstance(build, str) and build:
+        message += f" (build {build})"
+    return message
+
+
 def use_dev_channel_for_tests() -> Callable[[], None]:
     """Make this TEST run speak the dev channel exactly as a user's process does
     (undoing either function above, for a test of the dev channel itself).

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev5}/src/chtypes/_ocifetch/_constants.py

@@ -1,6 +1,6 @@
 # Code generated by scripts/fetch-v1/gen-constants.py from
 # spec/fetch-v1/constants.json. DO NOT EDIT.
-# Source sha256: 163dbaa1e5173aa65de7d46f1eac27c02f862e96b5c8160a23fee8cfabd77a2a
+# Source sha256: 4554956faeb154fc324a6120b7b35976222c6bc8ecbce7fd0147502e3073611d
 """The v1 fetch constants, generated: see docs/guides/fetch-v1.md."""
 
 from __future__ import annotations
@@ -83,6 +83,7 @@ RETRY_AFTER_STATUSES: Final[tuple[int, ...]] = (429, 503)
 RETRY_AFTER_OVER_BUDGET: Final[str] = "refuse"
 DIGEST_404_POLICY: Final[str] = "next_base_then_retry_on_last"
 TAG_404_POLICY: Final[str] = "next_base_then_unpublished"
+RETIRED_STATUSES: Final[tuple[int, ...]] = (410,)
 
 CONNECT_TIMEOUT_S: Final[float] = 30.0
 IDLE_READ_TIMEOUT_S: Final[float] = 60.0
@@ -95,6 +96,8 @@ MAX_REFERRERS: Final[int] = 16
 MAX_REDIRECTS: Final[int] = 5
 MAX_UNPACKED_BYTES: Final[int] = 4294967296
 ZSTD_WINDOW_LOG_MAX: Final[int] = 27
+RETIRED_BODY_MAX_BYTES: Final[int] = 65536
+RETIRED_MESSAGE_MAX_CODE_POINTS: Final[int] = 256
 
 CACHE_ROOT_TEMPLATE: Final[str] = "${XDG_CACHE_HOME:-$HOME/.cache}/chtypes/v1"
 SYSTEM_CACHE_DIRS: Final[tuple[str, ...]] = ("/usr/local/share/chtypes/v1", "/opt/chtypes/v1")
@@ -122,4 +125,5 @@ ERROR_EXIT_CODES: Final[dict[str, int]] = {
     "CHTYPES_SOURCE_INCOMPATIBLE": 7,
     "CHTYPES_ARTIFACT_INCOMPATIBLE": 8,
     "CHTYPES_CACHE_UNUSABLE": 9,
+    "CHTYPES_SOURCE_RETIRED": 10,
 }

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev5}/src/chtypes/_ocifetch/_ensure.py

@@ -38,6 +38,7 @@ from chtypes._ocifetch._errors import (
     ArtifactUntrustedError,
     FetchError,
     SourceForbiddenError,
+    SourceRetiredError,
     SourceUnauthorizedError,
     SourceUnreachableError,
 )
@@ -49,6 +50,7 @@ from chtypes._ocifetch._http import (
     ForbiddenHttpError,
     NotFoundHttpError,
     OversizeHttpError,
+    RetiredHttpError,
     RetryPolicy,
     TransportError,
     UnauthorizedHttpError,
@@ -440,7 +442,7 @@ def _find_verified_signature(
                 bases, ref.digest, policy=policy, retry=retry
             )
             blob_desc = manifest_single_layer(referrer_doc, expected_media_type=C.MEDIA_TYPE_BUNDLE)
-        except ArtifactCorruptError:
+        except (ArtifactCorruptError, RetiredHttpError):
             raise
         except (TransportError, FetchError):
             continue
@@ -458,7 +460,7 @@ def _find_verified_signature(
             with open(bundle_path, "rb") as f:
                 bundle_json = json.loads(f.read())
             verified = verify_bundle(bundle_json, trusted_keys)
-        except ArtifactCorruptError:
+        except (ArtifactCorruptError, RetiredHttpError):
             raise
         except (TransportError, FetchError, json.JSONDecodeError):
             continue
@@ -698,7 +700,7 @@ def _ensure_floating(
     cache_root_path = roots[0]
     scratch_root = _scratch_root(cache_root_path)
 
-    index_doc, index_bytes, index_digest = fetch_manifest_by_tag(
+    index_doc, index_bytes, index_digest, alias_absent = fetch_manifest_by_tag(
         bases,
         request.spelling,
         policy=policy,
@@ -711,6 +713,14 @@ def _ensure_floating(
     existing_dir = unpacked_dir_for(cache_root_path, manifest_hex)
     existing_record = read_verified_record(existing_dir)
     if existing_record is not None and existing_record.platform == platform_key:
+        # An install of another fingerprint's build, reached through the tag
+        # because the registry has none at this SDK's own, is never reported
+        # installed (public issue #578): refused before the cache is touched.
+        _channel.ahead_of_registry(
+            alias_absent,
+            existing_record.predicate,
+            cached_own_build=lambda: _cached_own_build(roots, platform_key, request.spelling),
+        )
         # A NEWER build within the request, installed beside it, is still the
         # answer ("monotonic-warning", docs/guides/fetch-v1.md §9).
         newer = _newer_installed(
@@ -801,6 +811,16 @@ def _ensure_floating(
         signed_by = verified.signed_by
 
     _check_predicate_matches_request(predicate, platform_key, request.spelling)
+    if found is not None:
+        # An SDK ahead of the registry (public issue #578): the alias for its
+        # own fingerprint answered 404 on every base, and the tag's build is
+        # signed for another. Refused from the signed statement, before the
+        # layer is requested, so nothing is downloaded or installed.
+        _channel.ahead_of_registry(
+            alias_absent,
+            predicate,
+            cached_own_build=lambda: _cached_own_build(roots, platform_key, request.spelling),
+        )
     newer = _newer_installed(roots, platform_key, predicate, request.spelling)
     if newer is not None:
         newer_dir, newer_record, warning = newer
@@ -983,6 +1003,8 @@ def _translate_transport_error(e: TransportError) -> FetchError:
         return SourceForbiddenError(f"chtypes: {e}")
     if isinstance(e, OversizeHttpError):
         return ArtifactCorruptError(f"chtypes: {e}")
+    if isinstance(e, RetiredHttpError):
+        return SourceRetiredError(f"chtypes: {e}")
     if isinstance(e, UnreachableHttpError):
         return SourceUnreachableError(f"chtypes: {e}", retryable=getattr(e, "retryable", True))
     return SourceUnreachableError(f"chtypes: {e}")
@@ -1221,6 +1243,25 @@ def with_notes(message: str, notes: Sequence[str]) -> str:
     return f"{message}. {' '.join(notes)}"
 
 
+def _cached_own_build(
+    roots: Sequence[Path], platform_key: str, request_spelling: str
+) -> str | None:
+    """The build id of the newest cached record of this SDK's OWN fingerprint
+    that answers the request (`resolve_installed`'s filter), "" when it names
+    none, or None when the cache holds no such record (public issue #581)."""
+    candidates = [
+        record
+        for _dir, record in list_verified_records(roots)
+        if record.platform == platform_key
+        and version_within_request(record.version, request_spelling)
+        and _channel.visible(record.predicate)
+    ]
+    if not candidates:
+        return None
+    best = max(candidates, key=lambda r: (spelling_components(r.version), r.build))
+    return best.build or ""
+
+
 def resolve_installed(request: Request, platform: str, options: Options) -> Resolved | None:
     """Cache-only: never touches the network (docs/guides/fetch-v1.md "The seam").
 
@@ -1368,7 +1409,9 @@ def _fetch_signed_impl(repository: str, ref: str, predicate_type: str, options:
         doc, _raw = fetch_manifest_by_digest(bases, ref, policy=policy, retry=retry)
         manifest_digest = ref
     else:
-        doc, _raw, manifest_digest = fetch_manifest_by_tag(bases, ref, policy=policy, retry=retry)
+        doc, _raw, manifest_digest, _alias_absent = fetch_manifest_by_tag(
+            bases, ref, policy=policy, retry=retry
+        )
 
     layer_desc = manifest_single_layer(doc)
     found = _find_verified_signature(
@@ -1466,6 +1509,8 @@ def _fetch_goldens(
                     retry=retry,
                     max_bytes=C.MAX_UNPACKED_BYTES,
                 )
+            except RetiredHttpError:
+                raise
             except (TransportError, FetchError) as e:
                 first_failure = first_failure or e
                 continue
@@ -1580,6 +1625,8 @@ def _verify_goldens_signature(
         except ArtifactCorruptError as e:
             failure = failure or e
             continue
+        except RetiredHttpError:
+            raise
         except (TransportError, FetchError, json.JSONDecodeError):
             continue
         finally:

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev5}/src/chtypes/_ocifetch/_errors.py

@@ -5,7 +5,7 @@ Scoped to `chtypes._ocifetch`: the stable, public exception types live in
 imports from or edits. A future switch lane decides how (or whether) these
 become public types; until then every name here is private.
 
-Every exception carries a `.code` string from one of the eleven codes
+Every exception carries a `.code` string from one of the twelve codes
 `spec/fetch-v1/constants.json`'s `errors` map assigns an exit status to
 (the generated `ERROR_EXIT_CODES` table), so a CLI added later needs no
 second mapping — it is the same lookup v0's `__main__.py` does today.
@@ -30,6 +30,7 @@ __all__ = [
     "CODE_CACHE_UNUSABLE",
     "CODE_SOURCE_FORBIDDEN",
     "CODE_SOURCE_INCOMPATIBLE",
+    "CODE_SOURCE_RETIRED",
     "CODE_SOURCE_UNAUTHORIZED",
     "CODE_SOURCE_UNREACHABLE",
     "ArtifactCorruptError",
@@ -41,6 +42,7 @@ __all__ = [
     "FetchError",
     "SourceForbiddenError",
     "SourceIncompatibleError",
+    "SourceRetiredError",
     "SourceUnauthorizedError",
     "SourceUnreachableError",
 ]
@@ -55,6 +57,7 @@ CODE_SOURCE_UNAUTHORIZED = "CHTYPES_SOURCE_UNAUTHORIZED"
 CODE_SOURCE_FORBIDDEN = "CHTYPES_SOURCE_FORBIDDEN"
 CODE_SOURCE_INCOMPATIBLE = "CHTYPES_SOURCE_INCOMPATIBLE"
 CODE_CACHE_UNUSABLE = "CHTYPES_CACHE_UNUSABLE"
+CODE_SOURCE_RETIRED = "CHTYPES_SOURCE_RETIRED"
 
 _CODES_USED_HERE = (
     CODE_ARTIFACT_MISSING,
@@ -67,6 +70,7 @@ _CODES_USED_HERE = (
     CODE_SOURCE_FORBIDDEN,
     CODE_SOURCE_INCOMPATIBLE,
     CODE_CACHE_UNUSABLE,
+    CODE_SOURCE_RETIRED,
 )
 
 # A drift guard, cheaper than a test: every code this module raises must be
@@ -187,3 +191,13 @@ class CacheUnusableError(FetchError):
         self.path = path
         self.reason = reason
         self.os_error = os_error
+
+
+class SourceRetiredError(FetchError):
+    """The source answered 410 Gone: a retired repository, which is permanent,
+    so the request was never retried and never sent to the next base
+    (docs/guides/fetch-v1.md §2, "A retired repository"; public issue #571).
+    The message names the URL that answered and carries the registry's own
+    message, made safe to print."""
+
+    code = CODE_SOURCE_RETIRED