mostlyright-data 0.31.9__tar.gz → 0.31.10__tar.gz

{mostlyright_data-0.31.9 → mostlyright_data-0.31.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mostlyright-data
-Version: 0.31.9
+Version: 0.31.10
 Summary: Mostly Right hosted CLI for reviewed datasets
 Project-URL: Homepage, https://mostlyright.md/
 Project-URL: Documentation, https://mostlyright.md/docs/guides/cli/
@@ -216,10 +216,11 @@ There is no `dev` extra to ask for -- `uv run --extra dev` answers
 tooling is the default dependency group, which `uv sync` installs.
 
 `make lint` is the repository's one lint set (`uv run ruff check .` plus `uv lock --check`); it is
-the first thing `make verify` runs and the same target the Linux leg of `thin-client-smoke.yml`
+the first thing `make verify` runs and the same target the checkout leg of `thin-client-smoke.yml`
 runs, so the two cannot disagree about what is linted.
 
 The test suite checks client behavior, contract compatibility and thin package ownership. Backend
 execution and worker-boundary tests run in Studio. The client supports Linux, macOS and Windows.
+CI runs on Linux only, on the AWS runner pool, so macOS and Windows are not tested there.
 
 To update the public Studio contract pin, run `make repin STUDIO_GIT=/path/to/studio STUDIO_REF=<commit>`. It reads committed OpenAPI and JSON Schema bytes, records their hashes and source commit in `vendor/studio-contracts/client-v4-pin.json`, and updates the thin client. Run the cross-repository tests against that Studio revision before release. Worker/client generation and backend job-contract repins now belong to Studio.

{mostlyright_data-0.31.9 → mostlyright_data-0.31.10}/README.md

@@ -201,10 +201,11 @@ There is no `dev` extra to ask for -- `uv run --extra dev` answers
 tooling is the default dependency group, which `uv sync` installs.
 
 `make lint` is the repository's one lint set (`uv run ruff check .` plus `uv lock --check`); it is
-the first thing `make verify` runs and the same target the Linux leg of `thin-client-smoke.yml`
+the first thing `make verify` runs and the same target the checkout leg of `thin-client-smoke.yml`
 runs, so the two cannot disagree about what is linted.
 
 The test suite checks client behavior, contract compatibility and thin package ownership. Backend
 execution and worker-boundary tests run in Studio. The client supports Linux, macOS and Windows.
+CI runs on Linux only, on the AWS runner pool, so macOS and Windows are not tested there.
 
 To update the public Studio contract pin, run `make repin STUDIO_GIT=/path/to/studio STUDIO_REF=<commit>`. It reads committed OpenAPI and JSON Schema bytes, records their hashes and source commit in `vendor/studio-contracts/client-v4-pin.json`, and updates the thin client. Run the cross-repository tests against that Studio revision before release. Worker/client generation and backend job-contract repins now belong to Studio.

{mostlyright_data-0.31.9 → mostlyright_data-0.31.10}/scripts/hatch_build.py

@@ -15,7 +15,7 @@ from hatchling.builders.hooks.plugin.interface import BuildHookInterface
 #
 # A compiled member would not, which is why the tag is not the only thing this hook does. It also
 # REFUSES TO BUILD when it finds one, rather than falling back to a platform tag: a fallback is
-# the worst outcome on the list, because the any-OS smoke matrix would keep passing while quietly
+# the worst outcome on the list, because the thin-client smoke would keep passing while quietly
 # testing a different artifact. A universal tag over a compiled payload is worse still -- it
 # installs everywhere and fails at import on all but one platform, on somebody else's machine.
 #

{mostlyright_data-0.31.9 → mostlyright_data-0.31.10}/skills/mr-data-build/references/making-a-table-incremental.md

@@ -603,16 +603,24 @@ again. Ask the user before passing either flag. Never pass one to clear a refusa
 
 Check `studio_capabilities.keyless_window` is literal `true` before using this grammar.
 An absent or false capability means "not available on this Studio yet". Registration and
-file explanation refuse with `THIN_GRAMMAR_NOT_SERVED` before local lint or registration;
-an older API's schema 422 on the explanation also refuses. No dataset delegation is written.
+file explanation refuse with `THIN_GRAMMAR_NOT_SERVED` before local lint or registration.
+An older API may answer the explanation with a schema 422 before it reports capabilities. The
+client then runs its local checks and lint. A local fault is reported as itself. Only a clean
+document is refused as not served. That refusal marks each member with the capability it needs,
+`keyless_post` members first. No dataset delegation is written.
 The capability covers `public.https.api@1.0.0`, `generic_api.auth.kind: none`, endpoint
 `epoch_millis`, the `epoch_millis_value` partition key, and the two request controls below. Existing credential-free file and collection
 adapters do not require this capability.
 
 For a public JSON/CSV API use `credential_mode: none`, an HTTPS `origin`, and `generic_api`
-with exact `auth: {"kind":"none"}`. Requests are GET-only, with no body or credential reference.
+with exact `auth: {"kind":"none"}`. A request is a GET, or a POST with a `body_template` on
+Studio 4.49. It states no credential reference. A POST needs `studio_capabilities.keyless_post`
+literal `true`. Otherwise registration refuses with `THIN_GRAMMAR_NOT_SERVED` and names the
+request `method` first, marked `(keyless_post)`. Send a GET in its place, or wait for the Studio
+deploy.
 Authenticated adapters retain their existing credential requirements. Declare both window
-endpoints with `location: parameter` and corresponding required request parameters. Origin,
+endpoints with `location: parameter` and corresponding required request parameters. A
+parameter fills its placeholder in the query, or in the body of a POST. Origin,
 host allowlists and cursor next-URL restrictions still apply.
 
 For Binance BTCUSDT one-minute klines, start the backfill at `2017-08-17T00:00:00Z` and request

{mostlyright_data-0.31.9 → mostlyright_data-0.31.10}/skills/mr-data-build/references/readers.md

@@ -173,8 +173,9 @@ response matches the family's exact media-type, settings, and budget contract.
 ### Needs Studio 4.26
 
 Check first: run `mr-data recipe explain RECIPE.json --json` and read `studio_capabilities`.
-Use `public.https.api@1.0.0` only when `keyless_window` is literal `true`; otherwise report
-"not available on this Studio yet". Registration and file explanation refuse with
+Use `public.https.api@1.0.0` only when `keyless_window` is literal `true`. Otherwise report
+"not available on this Studio yet". A POST request needs Studio 4.49 and `keyless_post` literal
+`true` as well. Registration and file explanation refuse with
 `THIN_GRAMMAR_NOT_SERVED`, including an older API's schema 422 before capabilities.
 
 The new adapter uses the existing `generic_api.response` Reader contract. For Binance klines,

{mostlyright_data-0.31.9 → mostlyright_data-0.31.10}/skills/mr-data-build/references/source-credentials.md

@@ -33,7 +33,8 @@ the user — the source needs a credential and which one — and nothing about t
 A [per-row request](sources.md#authoring-a-per-row-request) presents a key by its source's
 `connector.credential_mode`.
 
-- `none` presents nothing, and the request is a `GET`.
+- `none` presents nothing. The request is a `GET`. Needs Studio 4.49: it may be a `POST` with a
+  `body_template` when `studio_capabilities.keyless_post` is literal `true`.
 - `opaque_reference` presents the secret named in `credential.secret_name`, the way
   `request.auth` says. A saved connection cannot stand in for it.
 - `platform` presents a key Mostly Right holds, so the user enrols nothing.

{mostlyright_data-0.31.9 → mostlyright_data-0.31.10}/skills/mr-data-build/references/sources.md

@@ -254,10 +254,15 @@ breaks a rule above.
 
 | `credential_mode` | State | Use it for |
 | --- | --- | --- |
-| `none` | no `credential`, no `auth`, method `GET` | a public API that takes no key |
+| `none` | no `credential` and no `auth`. A `GET`, or a `POST` with `body_template` (Needs Studio 4.49) | a public API that takes no key |
 | `opaque_reference` | `credential.secret_name` and `request.auth` | a key the user enrolled with `mr-data keys set` |
 | `platform` | no `credential` and no `auth` | an endpoint Mostly Right holds a key for |
 
+A keyless per-row `POST` needs Studio 4.49. Use it only when `keyless_post` is literal `true` in
+`studio_capabilities`. Otherwise the client refuses with `THIN_GRAMMAR_NOT_SERVED` and names the
+request `method` first, marked `(keyless_post)`. Send a GET in its place, or wait for the Studio
+deploy.
+
 The platform credential needs no key from anyone, and any subscribed workspace may use it. Each
 binding is one route and one pinned model, and `mr-data models --json` lists the ones this
 deployment serves: Clef for classification (`classify`), TypeSafe's Jev through OpenRouter
@@ -378,18 +383,80 @@ full grammar.
 ### Needs Studio 4.26
 
 Check first: run `mr-data recipe explain RECIPE.json --json` and read `studio_capabilities`.
-Use the following only when `keyless_window` is literal `true`; otherwise report "not available
-on this Studio yet". The client refuses with `THIN_GRAMMAR_NOT_SERVED` before registration,
-including when an older API rejects the explanation document with schema 422.
+Use the following only when `keyless_window` is literal `true`. Otherwise report "not available
+on this Studio yet". The client refuses with `THIN_GRAMMAR_NOT_SERVED` before registration.
+An older API may reject the explanation document with a schema 422 before it reports
+capabilities. The client then runs its local checks and lint. A local fault is reported as
+itself. Only a clean document is refused as not served. That refusal marks each member with the
+capability it needs, `keyless_post` members first.
 
 `public.https.api@1.0.0` is the credential-free generic HTTPS API adapter. State
 `credential_mode: none`, `origin`, and `generic_api` with exact `auth: {"kind":"none"}`.
-Use GET only: no request body, credential reference, token, secret header or secret query value.
+A request is a GET, or a POST with a `body_template` on Studio 4.49. It presents no credential:
+no credential reference, token, secret header or secret query value.
 This adapter does not relax authentication on the keyed adapters. The owned HTTPS origin,
 host allowlist, bounded request budgets and cursor next-URL restrictions remain in force.
 The existing generic response mapping and JSON/CSV pagination apply; a cursor needs the
 publisher's actual next-token pointer. JSON-pointer pagination does not extract XML OAI-PMH tokens.
 
+Needs Studio 4.49. Some APIs take the date range in a JSON body. Send a POST and state the body
+in `body_template`. Use it only when `keyless_post` is literal `true` in `studio_capabilities`.
+Otherwise the client refuses with `THIN_GRAMMAR_NOT_SERVED` and names
+`generic_api/request/method` first, marked `(keyless_post)`. Send a GET in its place, or wait for
+the Studio deploy.
+Declare both window endpoints with `location: parameter`. Each endpoint fills the body
+placeholder of the parameter it names. One request covers one window unit, so state
+`pagination: {"kind": "none", "max_pages": 1}`. The values frozen in `connector.parameters` are
+the first day of the window, the day `start_at` names. This response is a root array, so
+`records_pointer` is `""`. Write `response.reader` the way [Readers](readers.md#needs-studio-426)
+shows. The publisher here is invented:
+
+```json
+{
+  "connector": {
+    "adapter_id": "public.https.api@1.0.0",
+    "credential_mode": "none",
+    "origin": "https://api.prices.example",
+    "parameters": [
+      {"name": "from_date", "value": "2026-01-01"},
+      {"name": "to_date", "value": "2026-01-01"}
+    ],
+    "generic_api": {
+      "request": {
+        "method": "POST",
+        "path_template": "/v1/prices/query",
+        "static_query": [],
+        "static_headers": [],
+        "body_template": {"market": "day_ahead", "from": "{from_date}", "to": "{to_date}"},
+        "parameters": [
+          {"name": "from_date", "type": "string", "required": true},
+          {"name": "to_date", "type": "string", "required": true}
+        ]
+      },
+      "auth": {"kind": "none"},
+      "response": {"format": "json", "records_pointer": ""},
+      "pagination": {"kind": "none", "max_pages": 1}
+    }
+  },
+  "window": {
+    "start_at": "2026-01-01T00:00:00Z",
+    "granularity": "day",
+    "timezone": "UTC",
+    "lookback_seconds": 86400,
+    "max_span_seconds": 31622400,
+    "request": {
+      "start": {"encoding": "iso_date", "bound": "inclusive", "location": "parameter", "parameter": "from_date"},
+      "end": {"encoding": "iso_date", "bound": "inclusive", "location": "parameter", "parameter": "to_date"}
+    },
+    "merge": {
+      "materialization": "partition_replace",
+      "partition": {"column": "date", "key": "iso_date_value"},
+      "row_identity": ["date", "hour"]
+    }
+  }
+}
+```
+
 For Binance klines use parameter-windowed `startTime`/`endTime`, millisecond endpoints and
 12-hour slices at one request per second. Follow the backfill and hourly-refresh example in
 [making a table incremental](making-a-table-incremental.md#keyless-api-windows-studio-426)

{mostlyright_data-0.31.9 → mostlyright_data-0.31.10}/src/mostlyright/data_harness/thin/recipe.py

@@ -168,7 +168,7 @@ _BOUNDED_STREAMING_POLICY = "bounded-streaming.v1"
 FILE_DECODER_COORDINATES: frozenset[tuple[str, str]] = frozenset(
     (family, version)
     for family, versions in {
-        "archive.gzip": ("1.0.0", "1.1.0", "2.0.0"),
+        "archive.gzip": ("1.0.0", "1.1.0", "2.0.0", "2.1.0"),
         "archive.tar": ("1.0.0", "1.1.0", "3.0.0", "4.0.0"),
         "archive.zip": ("1.0.0", "1.1.0", "1.2.0", "1.3.0", "1.4.0", "1.5.0", "3.0.0"),
         "delimited_text": ("1.0.0", "1.1.0", "2.0.0"),
@@ -1431,9 +1431,10 @@ def register(
 ) -> dict[str, Any]:
     """``mr-data recipe FILE``: register one document and print what the server derived from it.
 
-    Existing documents are linted before a credential is resolved. A keyless-window document
-    asks what Studio serves before local lint, because an older schema may reject the grammar
-    before reporting capabilities. The brief and delegation gates follow; registration is last.
+    Existing documents are linted before a credential is resolved. A document using keyless
+    grammar (``keyless_window`` or ``keyless_post``) asks what Studio serves before local lint,
+    because an older schema may reject the grammar before reporting capabilities. The brief and
+    delegation gates follow, and registration is last.
     """
 
     document = read_document(Path(args.target))
@@ -1442,13 +1443,16 @@ def register(
     v4.recipe_registration_body(document, "00000000-0000-0000-0000-000000000000")
     # New grammar must be refused as unserved before local lint can diagnose its shape.
     keyless = any(
-        capability == "keyless_window" for _, capability in recipe_explain.gated_grammar(document)
+        capability in recipe_explain.KEYLESS_CAPABILITIES
+        for _, capability in recipe_explain.gated_grammar(document)
     )
     selected = client
     served = []
     if keyless:
         selected = selected or _client(args)
-        served = recipe_explain.registration_gate(selected, document)
+        served = recipe_explain.registration_gate(
+            selected, document, lint=not getattr(args, "no_lint", False)
+        )
     check_document(document)
     if not getattr(args, "no_lint", False):
         refusal = lint_refusal(

{mostlyright_data-0.31.9 → mostlyright_data-0.31.10}/src/mostlyright/data_harness/thin/recipe_explain.py

@@ -35,6 +35,13 @@ from urllib.parse import parse_qsl, urlsplit
 from uuid import UUID
 
 from mostlyright.data_harness.thin import THIN_SCHEMA_PREFIX, numbered
+from mostlyright.data_harness.thin.recipe_lint import (
+    KEYLESS_API_ADAPTER_ID,
+    ROW_REQUEST_ADAPTER_ID,
+    lint_document,
+    lint_refusal,
+)
+from mostlyright.data_harness.thin.studio_capabilities import KEYLESS_CAPABILITIES, KEYLESS_POST
 from mostlyright.data_harness.thin.transport import ThinLaneError
 from mostlyright.data_harness.thin.v4 import (
     EXPLAIN_AND_FORECAST_REQUEST_VERSION,
@@ -131,6 +138,7 @@ CAPABILITY_NAMES: tuple[str, ...] = (
     "snapshot_refresh",
     "row_request_batch",
     "keyless_window",
+    "keyless_post",
 )
 
 #: What a Studio that answers 404 or 405 from the explanation routes serves (README D27).
@@ -1228,12 +1236,17 @@ def _explanation(answer: Any, path: str) -> dict[str, Any]:
 
 
 def explain_document_at_studio(
-    client: StudioV4Client, document: Mapping[str, Any]
+    client: StudioV4Client, document: Mapping[str, Any], *, lint: bool = True
 ) -> dict[str, Any] | None:
     """``POST /v4/recipes:explain-refresh``, or ``None`` when this Studio does not serve it.
 
     Studio judges the document alone: it reads no predecessor, registers nothing and writes
     nothing, which is what makes it safe to ask before a registration.
+
+    An older API's schema answers 422 to a keyless document, and also to a document that is
+    simply wrong. So that 422 is checked against the local document rules and, unless ``lint`` is
+    false, the local lint. A local fault is raised as itself. Only a document that passes both is
+    reported as not served.
     """
 
     body = {
@@ -1254,23 +1267,66 @@ def explain_document_at_studio(
         if route_unavailable(refusal):
             return None
         keyless = [
-            pointer
+            (pointer, capability)
             for pointer, capability in gated_grammar(document)
-            if capability == "keyless_window"
+            if capability in KEYLESS_CAPABILITIES
         ]
         if keyless and getattr(refusal, "http_status", None) == 422:
+            _raise_local_fault(document, lint=lint, cause=refusal)
             # Older API schemas reject the document before they can answer capabilities.
             # A schema rejection is never evidence that this grammar is served.
             raise ThinLaneError(
                 GRAMMAR_NOT_SERVED_CODE,
-                f"not available on this Studio yet: {', '.join(keyless)} "
-                "(Studio rejected the explanation document before reporting capabilities). "
-                "Nothing was registered. Wait for the Studio deploy, or remove the member",
+                not_served_detail(
+                    keyless,
+                    "Studio rejected the explanation document before reporting capabilities, "
+                    "and the document passes the local checks",
+                    known=False,
+                ),
             ) from refusal
         raise
     return _explanation(answer, EXPLAIN_REFRESH_PATH)
 
 
+def _raise_local_fault(document: Mapping[str, Any], *, lint: bool, cause: ThinLaneError) -> None:
+    """Raise the local finding a schema 422 may stand for, or return when there is none."""
+
+    from mostlyright.data_harness.thin import recipe as recipe_module
+
+    try:
+        recipe_module.check_document(dict(document))
+    except ThinLaneError as fault:
+        raise fault from cause
+    if lint:
+        fault = lint_refusal(lint_document(document), subject="the recipe document")
+        if fault is not None:
+            raise fault from cause
+
+
+def not_served_detail(missing: Sequence[tuple[str, str]], why: str, *, known: bool) -> str:
+    """The not-served sentence: each pointer with the capability it needs, ``keyless_post`` first.
+
+    A keyless POST is the newest gated grammar, so where one is listed its method is named first
+    and its repair is a GET in its place. ``known`` says whether Studio stated that the other
+    members are unserved. After a schema 422 it did not, so they are not told to be removed.
+    """
+
+    ordered = sorted(missing, key=lambda item: item[1] != KEYLESS_POST)
+    listed = ", ".join(f"{pointer} ({capability})" for pointer, capability in ordered)
+    post = any(capability == KEYLESS_POST for _, capability in missing)
+    others = any(capability != KEYLESS_POST for _, capability in missing)
+    if post and others and known:
+        repair = "send each keyless_post request as a GET, and remove the other members"
+    elif post:
+        repair = "send each keyless_post request as a GET"
+    else:
+        repair = "remove the member"
+    return (
+        f"not available on this Studio yet: {listed}. {why}. Nothing was registered. Wait for "
+        f"the Studio deploy, or {repair}"
+    )
+
+
 def explain_table_at_studio(client: StudioV4Client, table_id: str) -> dict[str, Any] | None:
     """``GET /v4/tables/{table_id}/refresh-explanation``, or ``None`` when it is not served."""
 
@@ -1308,7 +1364,9 @@ def gated_grammar(document: Mapping[str, Any]) -> list[tuple[str, str]]:
     ``row_filter`` on any collection discovery, and a per-row request collection whose
     ``pages.revisit`` states ``interval`` (4.14.0). A revisit on any other collection is old
     grammar. ``batch`` on a per-row request (4.15.0). The public generic API, no-auth kind,
-    millisecond endpoints and slice/pacing members (4.26.0) each need ``keyless_window``.
+    millisecond endpoints and slice/pacing members (4.26.0) each need ``keyless_window``. A POST
+    that presents no credential (4.49.0) needs ``keyless_post``: a ``public.https.api@1.0.0``
+    request, or a per-row request under ``credential_mode: none``. Its pointer is the method.
     """
 
     gated: list[tuple[str, str]] = []
@@ -1323,12 +1381,16 @@ def gated_grammar(document: Mapping[str, Any]) -> list[tuple[str, str]]:
         prefix = f"/sources/{index}"
         connector = source.get("connector")
         if isinstance(connector, Mapping):
-            if connector.get("adapter_id") == "public.https.api@1.0.0":
+            keyless_api = connector.get("adapter_id") == KEYLESS_API_ADAPTER_ID
+            if keyless_api:
                 gated.append((f"{prefix}/connector/adapter_id", "keyless_window"))
             generic = connector.get("generic_api")
             auth = generic.get("auth") if isinstance(generic, Mapping) else None
             if isinstance(auth, Mapping) and auth.get("kind") == "none":
                 gated.append((f"{prefix}/connector/generic_api/auth/kind", "keyless_window"))
+            request = generic.get("request") if isinstance(generic, Mapping) else None
+            if keyless_api and isinstance(request, Mapping) and request.get("method") == "POST":
+                gated.append((f"{prefix}/connector/generic_api/request/method", "keyless_post"))
         window = source.get("window")
         merge = window.get("merge") if isinstance(window, Mapping) else None
         partition = merge.get("partition") if isinstance(merge, Mapping) else None
@@ -1363,6 +1425,14 @@ def gated_grammar(document: Mapping[str, Any]) -> list[tuple[str, str]]:
             gated.append(
                 (f"/sources/{index}/collection/discovery/request/batch", "row_request_batch")
             )
+        if (
+            isinstance(connector, Mapping)
+            and connector.get("adapter_id") == ROW_REQUEST_ADAPTER_ID
+            and connector.get("credential_mode") == "none"
+            and isinstance(request, Mapping)
+            and request.get("method") == "POST"
+        ):
+            gated.append((f"/sources/{index}/collection/discovery/request/method", "keyless_post"))
     return gated
 
 
@@ -1381,7 +1451,9 @@ def snapshot_sources(document: Mapping[str, Any]) -> list[str]:
     return named
 
 
-def registration_gate(client: StudioV4Client, document: Mapping[str, Any]) -> list[str]:
+def registration_gate(
+    client: StudioV4Client, document: Mapping[str, Any], *, lint: bool = True
+) -> list[str]:
     """Refuse grammar this Studio does not serve, and return the snapshot warning when it applies.
 
     Asks the document route only when the answer can change what happens: the document uses
@@ -1389,14 +1461,15 @@ def registration_gate(client: StudioV4Client, document: Mapping[str, Any]) -> li
     other document registers exactly as before, with no extra request.
 
     ⚠ REFUSED BEFORE ANYTHING IS WRITTEN. The caller runs this before the brief gate's delegation
-    append and before the registration, so a refusal here leaves nothing behind.
+    append and before the registration, so a refusal here leaves nothing behind. ``lint`` is
+    false under ``--no-lint``, so an older schema's 422 is then not checked against local lint.
     """
 
     gated = gated_grammar(document)
     snapshots = snapshot_sources(document)
     if not gated and not snapshots:
         return []
-    answer = explain_document_at_studio(client, document)
+    answer = explain_document_at_studio(client, document, lint=lint)
     return grammar_gate(document, answer)
 
 
@@ -1406,18 +1479,16 @@ def grammar_gate(document: Mapping[str, Any], answer: Mapping[str, Any] | None)
     gated = gated_grammar(document)
     snapshots = snapshot_sources(document)
     capabilities = served_capabilities(answer)
-    missing = [pointer for pointer, capability in gated if not capabilities[capability]]
+    missing = [
+        (pointer, capability) for pointer, capability in gated if not capabilities[capability]
+    ]
     if missing:
         why = (
-            "this Studio does not serve the refresh explanation, so it predates 4.14.0"
+            "This Studio does not serve the refresh explanation, so it predates 4.14.0"
             if answer is None
-            else "this Studio's capabilities say it does not serve it"
-        )
-        raise ThinLaneError(
-            GRAMMAR_NOT_SERVED_CODE,
-            f"not available on this Studio yet: {', '.join(missing)} ({why}). Nothing was "
-            "registered. Wait for the Studio deploy, or remove the member",
+            else "This Studio's capabilities say it does not serve them"
         )
+        raise ThinLaneError(GRAMMAR_NOT_SERVED_CODE, not_served_detail(missing, why, known=True))
     if snapshots and not capabilities["snapshot_refresh"]:
         return [
             f"{SNAPSHOT_WILL_NOT_REFRESH_YET}: {', '.join(repr(name) for name in snapshots)} "
@@ -1513,7 +1584,9 @@ def explain(args: argparse.Namespace, *, client: StudioV4Client | None = None) -
     else:
         document = recipe_module.read_document(Path(target))
         selected = client or recipe_module._client(args)
-        keyless = any(capability == "keyless_window" for _, capability in gated_grammar(document))
+        keyless = any(
+            capability in KEYLESS_CAPABILITIES for _, capability in gated_grammar(document)
+        )
         if keyless:
             answer = explain_document_at_studio(selected, document)
             grammar_gate(document, answer)
@@ -1625,6 +1698,7 @@ __all__ = [
     "EXPLAIN_REFRESH_PATH",
     "EXPLAIN_SCHEMA",
     "GRAMMAR_NOT_SERVED_CODE",
+    "KEYLESS_CAPABILITIES",
     "MIRRORED_RULE_CODES",
     "NO_CAPABILITIES",
     "ROUTES_REQUEST_VERSION",

{mostlyright_data-0.31.9 → mostlyright_data-0.31.10}/src/mostlyright/data_harness/thin/recipe_lint.py

@@ -161,6 +161,9 @@ COHERENCE_CREDENTIAL_MODES: frozenset[str] = frozenset({"none", "opaque_referenc
 #: ``request`` instead of ``url_column``, on a source declared through this adapter.
 ROW_REQUEST_ADAPTER_ID = "public.https.collection@2.0.0"
 
+#: The generic API adapter that presents no credential (4.26.0).
+KEYLESS_API_ADAPTER_ID = "public.https.api@1.0.0"
+
 #: One per-row template token, read left to right: an escaped brace, a ``{name}`` placeholder, a
 #: lone brace, or a run of text with no brace. The registration route and the worker read every
 #: per-row template with this same expression, and no per-row template pattern of
@@ -237,6 +240,7 @@ def lint_document(document: Mapping[str, Any]) -> list[Finding]:
     findings.extend(_refresh_trigger(document))
     findings.extend(_row_filters(document.get("sources")))
     findings.extend(_row_request_credentials(document.get("sources")))
+    findings.extend(_keyless_api_requests(document.get("sources")))
     findings.extend(_row_request_templates(document.get("sources")))
     findings.extend(_units(document.get("units")))
     findings.extend(_coherence(document, declared=declared))
@@ -908,7 +912,10 @@ def _row_request_credentials(sources: Any) -> list[Finding]:
       request's origin, method and path says which credential is presented and how.
     - ``opaque_reference`` names a workspace secret in ``credential.secret_name`` and states
       ``auth``, which says how that secret is presented.
-    - ``none`` states no ``auth`` and sends a GET.
+    - ``none`` states no ``auth``.
+
+    Whatever the mode, a request sends a GET with no ``body_template``, or a POST with one.
+    ``batch`` stays GET-only, which :func:`_row_request_batch_coherence` holds.
 
     Each is a schema rule, so each finding carries :data:`DOCUMENT_INVALID`. Which binding admits
     a ``platform`` request is deployment configuration that no document carries, so that question
@@ -1006,16 +1013,87 @@ def _row_request_credentials(sources: Any) -> list[Finding]:
                         "name one with 'opaque_reference', or drop it",
                     )
                 )
-            method = request.get("method")
-            if "method" in request and method != "GET":
-                findings.append(
-                    Finding(
-                        DOCUMENT_INVALID,
-                        f"{at}/method",
-                        f"is {method!r}, and a per-row request that presents no credential is a "
-                        "GET",
-                    )
+        if request is not None:
+            findings.extend(_request_method(request, at=at, subject="A per-row request"))
+    return findings
+
+
+def _request_method(request: Mapping[str, Any], *, at: str, subject: str) -> list[Finding]:
+    """The generic request rule: a GET states no ``body_template``, and a POST states one.
+
+    ``subject`` begins the sentence a wrong method earns. A request that states no method is the
+    schema's missing-member fault, and nothing is read off it here.
+    """
+
+    if "method" not in request:
+        return []
+    method = request.get("method")
+    if _outside(method, frozenset({"GET", "POST"})):
+        return [
+            Finding(
+                DOCUMENT_INVALID,
+                f"{at}/method",
+                f"is {method!r}. {subject} is a GET, or a POST with a body_template",
+            )
+        ]
+    if method == "POST" and "body_template" not in request:
+        return [
+            Finding(
+                DOCUMENT_INVALID,
+                f"{at}/body_template",
+                "is absent, and a POST sends the body this member renders",
+            )
+        ]
+    if method == "GET" and "body_template" in request:
+        return [
+            Finding(
+                DOCUMENT_INVALID,
+                f"{at}/body_template",
+                "is stated on a GET, which sends no body. Make the request a POST, or drop it",
+            )
+        ]
+    return []
+
+
+def _keyless_api_requests(sources: Any) -> list[Finding]:
+    """A ``public.https.api@1.0.0`` request, held to the rules Studio's parser holds it to.
+
+    The adapter presents no credential, so ``generic_api.auth`` is exactly ``{"kind": "none"}``.
+    Its request is a GET with no ``body_template``, or a POST with one (4.49.0). Each is a schema
+    rule, so each finding carries :data:`DOCUMENT_INVALID`.
+    """
+
+    if not isinstance(sources, list):
+        return []
+    findings: list[Finding] = []
+    for index, source in enumerate(sources):
+        if not isinstance(source, Mapping):
+            continue
+        connector = source.get("connector")
+        if not isinstance(connector, Mapping):
+            continue
+        generic = connector.get("generic_api")
+        if connector.get("adapter_id") != KEYLESS_API_ADAPTER_ID or not isinstance(
+            generic, Mapping
+        ):
+            continue
+        at = f"/sources/{index}/connector/generic_api"
+        if "auth" in generic and generic.get("auth") != {"kind": "none"}:
+            findings.append(
+                Finding(
+                    DOCUMENT_INVALID,
+                    f"{at}/auth",
+                    f"is {generic.get('auth')!r}. A {KEYLESS_API_ADAPTER_ID} source presents no "
+                    'credential, so its auth is exactly {"kind": "none"}',
+                )
+            )
+        request = generic.get("request")
+        if isinstance(request, Mapping):
+            findings.extend(
+                _request_method(
+                    request, at=f"{at}/request", subject=f"A {KEYLESS_API_ADAPTER_ID} request"
                 )
+            )
     return findings
 
 
@@ -1292,8 +1370,7 @@ def _row_request_batch_coherence(sources: Any) -> list[Finding]:
                     Finding(
                         DOCUMENT_INCOHERENT,
                         f"{at}/batch/parameter",
-                        f"names {name!r}, which must be declared with required: true to be "
-                        "batched",
+                        f"names {name!r}, which must be declared with required: true to be batched",
                     )
                 )
             sites = [
@@ -1354,8 +1431,7 @@ def _table_partition_coherence(document: Mapping[str, Any], *, known: set[str])
     sources = document.get("sources")
     sources = sources if isinstance(sources, list) else []
     if any(
-        isinstance(source, Mapping) and source.get("source_class") == "stream"
-        for source in sources
+        isinstance(source, Mapping) and source.get("source_class") == "stream" for source in sources
     ):
         findings.append(
             Finding(