composable-data-stack 0.9.0__py3-none-any.whl → 0.9.1__py3-none-any.whl

cli/image_verification.py

@@ -280,13 +280,14 @@ def _fixture_entry(
     fixture: dict[str, Any] | None,
     image_ref: str,
 ) -> dict[str, Any] | None:
-    """Return the fixture entry whose repository matches image_ref, if any."""
+    """Return the repository entry matching image_ref, preferring its digest."""
     if fixture is None:
         return None
     images = fixture.get("images", {})
     if not isinstance(images, dict):
         return None
     folded_image_ref = image_ref.casefold()
+    matches: list[dict[str, Any]] = []
     for entry in images.values():
         if not isinstance(entry, dict):
             continue
@@ -297,8 +298,16 @@ def _fixture_entry(
         if folded_image_ref == folded_repository or folded_image_ref.startswith(
             (folded_repository + "@", folded_repository + ":")
         ):
-            return entry
-    return None
+            matches.append(entry)
+    if not matches:
+        return None
+    if "@sha256:" in folded_image_ref:
+        ref_digest = folded_image_ref.rsplit("@", 1)[1]
+        for entry in matches:
+            digest = entry.get("digest")
+            if isinstance(digest, str) and digest.casefold() == ref_digest:
+                return entry
+    return matches[0]
 
 
 def _verification_findings(

cli/k8s_renderer.py

@@ -1374,6 +1374,11 @@ def _values_config(value: Any) -> Any:
 
 
 def _write_chart(root: Path, files: dict[str, str]) -> None:
+    # Canonicalize before touching the filesystem (same convention as
+    # `_atomic_write()`), so a caller-supplied `--output`/`--chart-dir`
+    # value is resolved to a single, unambiguous absolute path rather than
+    # acted on as a raw, possibly relative/traversal-bearing string.
+    root = root.resolve()
     root.parent.mkdir(parents=True, exist_ok=True)
     staging = Path(tempfile.mkdtemp(prefix=f".{root.name}.tmp-", dir=root.parent))
     backup = staging.with_name(staging.name.replace(".tmp-", ".previous-"))

cli/k8s_runner.py

@@ -2,7 +2,9 @@
 from __future__ import annotations
 
 import json
+import math
 import os
+import re
 import subprocess  # nosec B404
 import tempfile
 from pathlib import Path
@@ -13,6 +15,70 @@ import yaml
 from .state import parse_k8s_workloads_json
 from .up_runner import _validate_command, run_streamed
 
+# RFC 1123 DNS label: lowercase alphanumeric and `-`, not leading/trailing
+# with `-`, 1-63 chars. Both Kubernetes namespaces and Helm release names
+# must already satisfy this, so enforcing it here rejects nothing legitimate.
+_K8S_NAME_RE = re.compile(r"[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?")
+
+# Kube contexts allow a wider character set (e.g. ARNs), but must not start
+# with `-` (which would be parsed as a flag) or contain control characters.
+_KUBE_CONTEXT_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9_.:@/-]*")
+
+
+def _validate_k8s_name(value: str, label: str) -> str:
+    """
+    Reject a `namespace`/`release` value that isn't a valid Kubernetes
+    DNS-1123 label before it reaches `helm`/`kubectl` as a command
+    argument. Without this, a value starting with `-` (e.g. supplied by a
+    misbehaving caller or automation) could be parsed as an extra flag by
+    the downstream binary instead of a plain name (CWE-88 argument
+    injection).
+
+    Returns a new string built only from the characters matched by the
+    allowlist regex (rather than the original object) so nothing beyond a
+    validated Kubernetes name can flow to the command it's used to build.
+    """
+    match = _K8S_NAME_RE.fullmatch(value) if isinstance(value, str) else None
+    if match is None:
+        raise ValueError(f"invalid {label}: {value!r} is not a valid Kubernetes name")
+    return match.group(0)
+
+
+def _validate_kube_context(value: str | None) -> str | None:
+    """
+    Reject a `kube_context` that looks like a command-line flag (starts
+    with `-`) or contains characters outside the safe allowlist, so it
+    can't be smuggled to `helm`/`kubectl` as an extra argument (CWE-88
+    argument injection).
+
+    Returns a new string built only from the allowlisted characters
+    (rather than the original object) so nothing beyond a validated
+    context name can flow to the command it's used to build.
+    """
+    if value is None:
+        return None
+    match = _KUBE_CONTEXT_RE.fullmatch(value) if isinstance(value, str) else None
+    if match is None:
+        raise ValueError(f"invalid kube context: {value!r}")
+    return match.group(0)
+
+
+def _validate_timeout(value: float) -> int:
+    """
+    Reject a `timeout` that isn't a finite, positive number before it is
+    interpolated into a `--timeout=<n>s` argument for `helm`/`kubectl`. A
+    non-finite or non-positive value (e.g. NaN, infinity, or a negative
+    number) could otherwise render as a string that isn't a plain
+    numeric suffix, which risks being parsed as an extra flag by the
+    downstream binary (CWE-88 argument injection).
+
+    Returns a newly constructed ``int`` (rather than the original tainted
+    object) clamped to at least 1 second.
+    """
+    if not isinstance(value, (int, float)) or isinstance(value, bool) or not math.isfinite(value):
+        raise ValueError(f"invalid timeout: {value!r} is not a finite number")
+    return max(1, int(value))
+
 
 def helm_up(
     plan: dict[str, Any],
@@ -26,10 +92,14 @@ def helm_up(
     log_file: IO[str],
 ) -> int:
     """Install or upgrade a rendered chart without persisting secret values."""
+    namespace = _validate_k8s_name(namespace, "namespace")
+    release = _validate_k8s_name(release, "release")
+    kube_context = _validate_kube_context(kube_context)
+    timeout = _validate_timeout(timeout)
     secret_values = _secret_values(plan)
     secret_path = _write_secret_values(secret_values)
     context_args = ["--kube-context", kube_context] if kube_context else []
-    timeout_arg = f"{max(1, int(timeout))}s"
+    timeout_arg = f"{timeout}s"
     command = [
         "helm",
         *context_args,
@@ -90,6 +160,10 @@ def helm_down(
     delete_pvcs: bool,
     log_file: IO[str],
 ) -> int:
+    namespace = _validate_k8s_name(namespace, "namespace")
+    release = _validate_k8s_name(release, "release")
+    kube_context = _validate_kube_context(kube_context)
+    timeout = _validate_timeout(timeout)
     pvc_names: list[str] = []
     if delete_pvcs:
         pvc_names = _stateful_pvc_names(
@@ -105,7 +179,7 @@ def helm_down(
         namespace,
         "--ignore-not-found",
         "--timeout",
-        f"{max(1, int(timeout))}s",
+        f"{timeout}s",
     ]
     result = run_streamed(command, log_file, timeout=timeout + 30)
     if result != 0 or not delete_pvcs or not pvc_names:
@@ -121,6 +195,9 @@ def helm_down(
 def get_k8s_workloads(
     namespace: str, release: str, kube_context: str | None
 ) -> list[dict[str, Any]]:
+    namespace = _validate_k8s_name(namespace, "namespace")
+    release = _validate_k8s_name(release, "release")
+    kube_context = _validate_kube_context(kube_context)
     command = _kubectl_command(kube_context, namespace) + [
         "get",
         "deployment,statefulset,job",

cli/main.py

@@ -961,7 +961,7 @@ def _render_helm_chart(plan, output_dir, force):
     compose target this refuses to write over existing unrelated content unless
     the caller passes --force.
     """
-    target_dir = Path(output_dir)
+    target_dir = Path(output_dir).resolve()
     if target_dir.exists() and not target_dir.is_dir():
         if not force:
             print(f"ERROR Helm output path {target_dir} exists and is not a directory. Pass --force to replace it.")
@@ -1610,7 +1610,7 @@ def main() -> int:
 
         if args.target == "helm":
             project_root = resolve_project_root(profile_path)
-            chart_dir = Path(args.chart_dir) if args.chart_dir else project_root / "chart"
+            chart_dir = (Path(args.chart_dir) if args.chart_dir else project_root / "chart").resolve()
             code, render_diags = _render_helm_chart(plan, chart_dir, force=True)
             all_diags.extend(render_diags)
             if code != 0 or has_errors(all_diags):
@@ -1620,9 +1620,9 @@ def main() -> int:
 
             namespace = args.namespace or plan.get("runtime", {}).get("namespace") or "cds-local"
             release = args.release or plan.get("metadata", {}).get("name") or "cds"
-            log_path = Path(args.log_file) if args.log_file else default_log_path(
-                Path(profile_path).parent.name
-            )
+            log_path = (
+                Path(args.log_file) if args.log_file else default_log_path(Path(profile_path).parent.name)
+            ).resolve()
             log_path.parent.mkdir(parents=True, exist_ok=True)
             try:
                 with open(log_path, "a", encoding="utf-8") as log_file:
@@ -1678,6 +1678,7 @@ def main() -> int:
             log_path = Path(args.log_file)
         else:
             log_path = default_log_path(Path(profile_path).parent.name)
+        log_path = log_path.resolve()
         log_path.parent.mkdir(parents=True, exist_ok=True)
 
         log_tail_process = None
@@ -1837,9 +1838,9 @@ def main() -> int:
             return 1
         project_root = resolve_project_root(profile_path)
         profile_release, profile_namespace = _k8s_runtime_defaults(profile_path)
-        log_path = Path(args.log_file) if args.log_file else default_log_path(
-            f"down-{Path(profile_path).parent.name}"
-        )
+        log_path = (
+            Path(args.log_file) if args.log_file else default_log_path(f"down-{Path(profile_path).parent.name}")
+        ).resolve()
         log_path.parent.mkdir(parents=True, exist_ok=True)
         try:
             with open(log_path, "a", encoding="utf-8") as log_file:

{composable_data_stack-0.9.0.dist-info → composable_data_stack-0.9.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: composable-data-stack
-Version: 0.9.0
+Version: 0.9.1
 Summary: CLI for validating and composing composable data stack profiles
 Author: Ronald Hensbergen
 License-Expression: Apache-2.0
@@ -32,15 +32,15 @@ Provides-Extra: dev
 Requires-Dist: coverage>=7.6; extra == "dev"
 Requires-Dist: bandit>=1.7; extra == "dev"
 Requires-Dist: pip-audit>=2.7; extra == "dev"
-Requires-Dist: ruff==0.16.7; extra == "dev"
+Requires-Dist: ruff==0.16.8; extra == "dev"
 Dynamic: license-file
 
 # 🚀 Composable Data Stack (CDS)
 
-> **Terraform for data platforms.**
-> Build, validate, secure, and evolve data stacks using modular components and explicit contracts.
+> **The modern data stack has a composition problem. CDS is an open framework
+> for building data platforms that can evolve without being rebuilt.**
 
-![Composable Data Stack logo](assets/branding/logo.svg)
+![Composable Data Stack logo](https://raw.githubusercontent.com/RonaldHensbergen/composable-data-stack/main/assets/branding/logo.svg)
 
 Project:
 
@@ -69,43 +69,122 @@ SonarCloud — Metrics:
 
 ---
 
-## 🧠 What Is CDS (In 1 Minute)
+You start with a straightforward goal: orchestrate some pipelines, store the
+data, and make it useful.
 
-Composable Data Stack (CDS) is a framework for defining and assembling data platforms from reusable modules such as orchestrators, warehouses, BI tools, and secrets providers.
+Then the tool decisions begin.
 
-## 🤝 Get Involved
+Airflow, Dagster, or Prefect? Iceberg, Delta, or Hudi? Superset or Metabase?
+Every choice opens another comparison, another integration, and another
+architecture diagram. Every diagram looks different. Every tool has its own
+configuration model, assumptions, and lifecycle. Before long, the platform is
+less a designed system than a collection of decisions held together by custom
+code and institutional memory.
 
-- **Star and follow** on GitHub: [RonaldHensbergen/composable-data-stack](https://github.com/RonaldHensbergen/composable-data-stack)
-- **Contribute**: open a discussion, file an issue, or send a PR to help shape CDS
-- **Proof it**: if you run it in a real workflow, share your feedback — good or bad
+The hardest question is no longer **"Which tool is best?"** It is **"How do
+these tools fit together, and can we change our minds later?"**
 
-> **Note:** Development helper tools are located in the `tools/` directory (git-ignored). See `tools/pr-cli/README.md` for PR creation scripts.
+## Why Data Platforms Have a Composition Problem
 
----
+The modern data ecosystem is excellent at producing capable tools and terrible
+at making them work as interchangeable parts.
 
-## ⚡ Why CDS
+Teams are expected to assemble orchestration, storage, transformation,
+cataloging, observability, security, and BI into one dependable platform. But
+the boundaries between those tools are usually implicit. Connection details
+leak into environment variables. Service names become dependencies. Deployment
+logic assumes a specific vendor. Compatibility lives in a staff engineer's
+head—or is discovered during an incident.
 
-Instead of hardcoding integrations or relying on fragile pipelines, CDS introduces:
+That fragmentation creates a familiar cycle:
 
-- 🔧 **Modules**: reusable components (Dagster, Postgres, Superset)
-- 🔗 **Contracts**: explicit interfaces between components
-- 🧩 **Profiles**: fully composed, runnable stacks
+- evaluate an overwhelming number of tools
+- debate architecture instead of delivering data products
+- hand-build integrations that only one team understands
+- duplicate stacks across development, CI, and production
+- postpone upgrades because nobody knows what they will break
+- accept lock-in because replacing one component feels like replacing the
+  platform
 
-Think of it as Infrastructure as Code, but for data platforms.
+This is not primarily a tooling problem. **It is a composition problem.** We
+have many good components, but no shared way to declare what they provide,
+what they need, and whether a particular assembly is valid.
 
-Modern data platforms force a trade-off:
+## The Cost of Choosing Wrong
 
-|Approach|Problem|
-|---|---|
-|Monolithic stack|Rigid, hard to evolve|
-|Custom pipelines|Flexible but fragile and inconsistent|
+A technology choice that looks local rarely stays local.
+
+Choose an orchestrator and its concepts spread into deployment, secrets,
+logging, and team workflows. Choose a table format and it constrains engines,
+catalogs, and migration paths. Choose a BI layer and dashboards become coupled
+to authentication, database behavior, and operational assumptions.
+
+The bill arrives later:
+
+- migrations become multi-quarter programs
+- upgrades become risky, manual compatibility exercises
+- platform teams maintain glue code instead of platform capabilities
+- product teams wait while engineers renegotiate architecture
+- vendors gain leverage because the cost of leaving keeps rising
+
+There is no universally correct stack, and pretending otherwise is expensive.
+The right choice today may be the wrong choice at a different scale, under a
+new regulatory constraint, or after the team learns more. A healthy platform
+must make change routine—not heroic.
+
+## What If Data Platforms Were Composable?
+
+What if a data platform described capabilities and interfaces before naming
+products?
+
+What if an orchestrator could request a database contract without hardcoding a
+specific database? What if a profile could declare a supported combination,
+validate it before deployment, and produce the runtime configuration? What if
+replacing a component meant satisfying the same contract instead of rebuilding
+every integration around it?
+
+That is the goal of **Composable Data Stack (CDS)**.
+
+CDS is an open-source framework for defining, validating, securing, and
+assembling data platforms from reusable components. Think of it as
+**Infrastructure as Code for the shape of a data platform**: the components,
+the interfaces between them, and the rules that make the whole stack coherent.
+
+CDS introduces three building blocks:
+
+- 🔧 **Modules** package reusable capabilities such as orchestration, storage,
+  BI, and secret management.
+- 🔗 **Contracts** define explicit, testable interfaces between those
+  capabilities.
+- 🧩 **Profiles** compose modules into supported, reproducible stacks.
 
-CDS gives you the best of both:
+Instead of burying platform architecture in scripts and tribal knowledge, CDS
+makes it declarative. It answers:
 
-- composability without chaos
-- flexibility with guarantees
-- modularity with structure
-- no vendor lock-in by design
+- **How do these tools fit together?** Through explicit contracts and declared
+  bindings.
+- **What happens if I replace a component later?** CDS validates the new
+  composition against the same requirements before runtime.
+- **How do I avoid vendor and technology lock-in?** Consumers depend on
+  capabilities, not hardcoded product identities.
+
+The result is composability without chaos, flexibility with guarantees, and a
+platform that can evolve without starting over.
+
+## ⚡ Why CDS
+
+Most teams are forced into one of two bad options:
+
+|Approach|What You Gain|What It Costs|
+|---|---|---|
+|Monolithic stack|A consistent starting point|Rigid boundaries and an expensive exit|
+|Custom integrations|Freedom to choose every component|Fragile glue, inconsistent stacks, and hidden coupling|
+|CDS|Explicit composition and replaceable components|A contract and profile model the community maintains together|
+
+CDS does not claim that every tool is interchangeable or that integration
+complexity disappears. It makes compatibility explicit, validates known
+constraints early, and gives the ecosystem a shared place to improve how tools
+compose.
 
 ---
 
@@ -113,10 +192,12 @@ CDS gives you the best of both:
 
 Use CDS if you:
 
+- expect your architecture to evolve as requirements change
 - want to swap tools (Airflow ↔ Dagster, Superset ↔ Metabase)
 - need reproducible environments across dev, CI, and prod
 - are building a platform for multiple teams
 - want contract-driven integration instead of implicit coupling
+- want to contribute to an open interoperability model for data tooling
 
 CDS may be overkill if:
 
@@ -125,7 +206,7 @@ CDS may be overkill if:
 
 ---
 
-## 🏗️ Example
+## 🏗️ See Composition in Practice
 
 The `local-dagster-postgres-superset` profile defines:
 
@@ -133,7 +214,7 @@ The `local-dagster-postgres-superset` profile defines:
 - Postgres -> storage
 - Superset -> BI
 
-### What CDS Does
+CDS then:
 
 1. Validates module definitions
 2. Resolves contract bindings
@@ -142,7 +223,8 @@ The `local-dagster-postgres-superset` profile defines:
 
 `cds plan` resolves the full dependency graph before runtime configuration is generated, ensuring all module interactions are valid and predictable.
 
-You can replace components without changing system behavior:
+The composition model creates a path to replace components while preserving
+the contracts the rest of the platform depends on:
 
 ```text
 Dagster -> Airflow
@@ -160,23 +242,7 @@ CDS wires modules through **contracts**, not direct dependencies. This section h
 
 Below, `local-dagster-postgres-superset` wires Dagster to Postgres to Superset through contracts:
 
-```mermaid
-flowchart TD
-    Dagster[Dagster]
-    Postgres[(Postgres)]
-    Superset[Superset]
-
-    Dagster -->|transformation-runner| Postgres
-    Postgres -->|warehouse-query| Superset
-
-    classDef tool stroke:#818cf8,fill:#eef2ff
-    classDef database stroke:#2dd4bf,fill:#f0fdfa
-    classDef viz stroke:#a78bfa,fill:#f5f3ff
-
-    class Dagster tool
-    class Postgres database
-    class Superset viz
-```
+![Dagster, Postgres, and Superset connected through contracts](https://raw.githubusercontent.com/RonaldHensbergen/composable-data-stack/main/docs/diagrams/architecture/architecture_overview.svg)
 
 ### Internal Flow
 
@@ -198,51 +264,7 @@ consumption in Superset), see
 [docs/profile-testing/test-plan.md](docs/profile-testing/test-plan.md) and
 [docs/profile-testing/failure-path-and-ci.md](docs/profile-testing/failure-path-and-ci.md).
 
-```mermaid
-flowchart TD
-    subgraph compile["Compile-time (cds)"]
-        direction TB
-        Profile[/profile.yaml/]
-        Validate[Validate]
-        Security["Security checks<br/>(cds test only)"]
-        Plan[Plan]
-        Render[Render]
-        Compose[/docker-compose.yaml/]
-        Stop1((stops here))
-
-        Profile --> Validate
-        Validate -->|structural + contract checks| Security
-        Security -->|rule-based checks| Plan
-        Plan -->|resolve + substitute| Render
-        Render --> Compose
-
-        Validate -.->|E020, E041, E042, E081| Stop1
-    end
-
-    subgraph runtime["Runtime (docker compose, cds up only)"]
-        direction TB
-        Build["docker compose build<br/>(skip with --no-build)"]
-        Up["docker compose up"]
-        Env[(".env file")]
-        Containers["running containers,<br/>real secret values injected"]
-
-        Build --> Up
-        Env -.->|resolves CDS_VAR| Up
-        Up --> Containers
-    end
-
-    Compose --> Build
-
-    classDef stage stroke:#818cf8,fill:#eef2ff
-    classDef artifact stroke:#2dd4bf,fill:#f0fdfa
-    classDef stop stroke:#f87171,fill:#fef2f2,stroke-dasharray: 3 3
-    classDef runtimeNode stroke:#a78bfa,fill:#f5f3ff
-
-    class Validate,Security,Plan,Render stage
-    class Profile,Compose artifact
-    class Stop1 stop
-    class Build,Up,Env,Containers runtimeNode
-```
+![CDS compile-time and runtime flow](https://raw.githubusercontent.com/RonaldHensbergen/composable-data-stack/main/docs/diagrams/processes/internal_flow.svg)
 
 This mirrors the [`cds` command table](#️-cli) below: `validate`, `plan`, and `render` are each callable on their own; `security` only runs as part of `cds test`, not `cds up`. Module and contract definitions follow the [Contract-First](#contract-first) design principle, so most of what "Validate" and "Plan" check comes directly from `module.yaml` and `profile.yaml`.
 
@@ -272,7 +294,7 @@ cds security local-dagster-postgres-superset
 
 ## 📦 What You Get
 
-When you run CDS:
+When a profile compiles, CDS produces:
 
 - validated module graph
 - resolved contract bindings
@@ -281,7 +303,9 @@ When you run CDS:
 - generated Helm chart for Kubernetes
 - reproducible stack definition
 
-This allows you to go from a declarative profile to a runnable local data stack.
+This turns a declarative platform design into a reproducible, runnable local
+data stack—and turns architectural assumptions into things the project can
+inspect, validate, and improve.
 
 ---
 
@@ -990,7 +1014,20 @@ See [docs/support-policy.md](docs/support-policy.md) for OS support policy and p
 
 ## 🤝 Contributing
 
-Contributions are welcome.
+CDS will only become a useful interoperability layer if the people building and
+operating data platforms shape it together.
+
+- **Run a profile** and report what works, what breaks, and what is missing.
+- **Document compatibility** between providers and consumers with evidence.
+- **Add or improve modules** without coupling them to a specific stack.
+- **Strengthen the model** through contracts, validation, security rules, and
+  representative profiles.
+- **Star and follow** the
+  [repository](https://github.com/RonaldHensbergen/composable-data-stack) if
+  you want to track the project.
+
+Real-world feedback is especially valuable. CDS should reflect how platforms
+actually fail and evolve, not how architecture diagrams pretend they do.
 
 Please read these first:
 
@@ -1002,12 +1039,8 @@ Please read these first:
 - [CHANGELOG.md](CHANGELOG.md)
 - [RELEASE.md](RELEASE.md)
 
-Good first contributions:
-
-- adding new modules
-- improving profile examples
-- extending contract definitions
-- adding validation or security rules
+Development helper tools are located in the gitignored `tools/` directory. See
+`tools/pr-cli/README.md` for PR creation scripts.
 
 ---
 

{composable_data_stack-0.9.0.dist-info → composable_data_stack-0.9.1.dist-info}/RECORD

@@ -4,12 +4,12 @@ cli/diagnostics.py,sha256=Vu_uY7OPJqrAvrG-DAcIjQVMiQ4WcGWSl32UYCtOCmA,260
 cli/getter.py,sha256=Q7YqG7KtcxJw8QP9dcnPU49GK6XWpEX07cUlMteMXZc,30243
 cli/graph.py,sha256=TNx0EuTVxN4G0EIs_9eX0_x7-So3XVMh6AYjgukMMZs,1828
 cli/image_updates.py,sha256=WCA5YNRJ2ctWJPI7xmja5T7qKJTndqpJ0qVp8dbvR8Q,11833
-cli/image_verification.py,sha256=7n-B_hf7WJ9ekIfQnd66dgl8eJCgzEoVyfPmlVwew-g,17975
-cli/k8s_renderer.py,sha256=WNOSf1UhJjV3srT2dCaX06zhQf6imaUtbADM3Yfe14A,51751
-cli/k8s_runner.py,sha256=ONe5eMoPQhBsTko5_2JR2syoE9a7yagCsUbnC_d0bJk,6475
+cli/image_verification.py,sha256=qNqH1IUji5LZgEgB7Qq7M1_lBzHzJCTT01aPWwSyKaM,18342
+cli/k8s_renderer.py,sha256=GiNn_Yu1IeFba9Rz5oFnr80QWYhqWtaf7hOOZ_Y0J8I,52063
+cli/k8s_runner.py,sha256=2zdYho-SpEhTNYxqzsUpb3J83OiBm6s0K7ASg9y4-4s,9983
 cli/k8s_security.py,sha256=VmQ_D6UkrgLcYSum4M6TPsRisHZNMFoqKtm682wz1Ps,5768
 cli/loader.py,sha256=KdP3sZTz8Ob5H97yE5h1tsCc5wtwZPjR7iFugxP1aPk,11825
-cli/main.py,sha256=dZoiAEXE6Rj2Yp3KZL4kSVfStAIYileGQ_IGdhMNrlk,98641
+cli/main.py,sha256=WZfFVlTJNTOgjFxrkZCZBwAYAogu6SWhHV5faAGYzp4,98725
 cli/overlay.py,sha256=t4G9Qj9n6z2ETC47ipjU78lfYHAJOFctMkYJP7aBOC4,15315
 cli/planner.py,sha256=gl2FGLXoGW0YzMUvCKlUjlylGHZ3jQ1WS_kYcoHuL0U,27866
 cli/preflight.py,sha256=Juby_q6mHghwwGRFvVdpf0AkPKHxR0JtoEo73neRWCQ,14089
@@ -28,9 +28,9 @@ cli/resources/module.schema.json,sha256=gehPtHEyfWz-Pcm9UavJOF7S3ctDvllZgi8cKolx
 cli/resources/profile.schema.json,sha256=fMN8dMyb-wHk8esimvopHlWIEEnozhVcCtBV-PM7j-s,6654
 cli/resources/rule-schema.json,sha256=uRhBGm7l18ey8lxEZsdJAOSrxUgcZuYUEvXi_f2bqyQ,6840
 cli/resources/rule-set.json,sha256=hHSJrJlCGh6gkh07KmG2qaN3k3pRSYowEbEeCAGOkXA,29411
-composable_data_stack-0.9.0.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-composable_data_stack-0.9.0.dist-info/METADATA,sha256=4DiLX79Mn9oDqm6LBfWGdLHJSk6gAfawk6mXjIU5oKM,37371
-composable_data_stack-0.9.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-composable_data_stack-0.9.0.dist-info/entry_points.txt,sha256=GBhnbsVzmlnBKLC5Do-tirjz3hTzOfgGXGuZNQxb5ak,38
-composable_data_stack-0.9.0.dist-info/top_level.txt,sha256=2ImG917oaVHlm0nP9oJE-Qrgs-fq_fGWgba2H1f8fpE,4
-composable_data_stack-0.9.0.dist-info/RECORD,,
+composable_data_stack-0.9.1.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+composable_data_stack-0.9.1.dist-info/METADATA,sha256=5wJ04Nj0gY2JIO1ke1Tcfp8J4tY4uPBNOxRIjb3oQjo,41015
+composable_data_stack-0.9.1.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+composable_data_stack-0.9.1.dist-info/entry_points.txt,sha256=GBhnbsVzmlnBKLC5Do-tirjz3hTzOfgGXGuZNQxb5ak,38
+composable_data_stack-0.9.1.dist-info/top_level.txt,sha256=2ImG917oaVHlm0nP9oJE-Qrgs-fq_fGWgba2H1f8fpE,4
+composable_data_stack-0.9.1.dist-info/RECORD,,