continuo-python-runtime 0.5.0__tar.gz → 0.7.0__tar.gz

{continuo_python_runtime-0.5.0 → continuo_python_runtime-0.7.0}/.github/workflows/images.yml

@@ -83,7 +83,7 @@ jobs:
         run: |
           docker run --rm --network host \
             -v "$PWD/tests/smoke/node_smoke:/app" \
-            -e NODE_ID=python-model.smoke.analytics.smoke \
+            -e NODE_ID=python-node.smoke.analytics.smoke \
             -e TABLE_NAME=smoke \
             -e TARGET_SCHEMA=analytics \
             -e POSTGRES_HOST=localhost \
@@ -134,7 +134,7 @@ jobs:
         run: |
           docker run --rm \
             -v "$PWD/tests/smoke/node_smoke:/app" \
-            -e NODE_ID=python-model.smoke.analytics.smoke \
+            -e NODE_ID=python-node.smoke.analytics.smoke \
             -e TABLE_NAME=smoke \
             -e TARGET_SCHEMA=analytics \
             -e TRINO_HOST=host.docker.internal \

{continuo_python_runtime-0.5.0 → continuo_python_runtime-0.7.0}/CHANGELOG.md

@@ -5,6 +5,29 @@ follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-09-29
+
+### Added
+
+- `python-api` node kind: a script node with no declared reads. It may name a
+  Kubernetes Secret with `secret_ref` (must match `continuo-api-*`), which
+  continuo attaches to the node's pod as env vars. `secret_ref` is rejected on
+  every other kind. Existing contracts and their content hashes are unchanged.
+
+## [0.6.0] - 2026-09-28
+
+### Breaking
+
+- The script node kind is named `python-node` (the default when `kind` is
+  omitted). A contract declaring `kind: python-model` is rejected at load.
+  Re-running `continuo-runtime merge` changes every python node's
+  `config_hash`, so each node is re-validated once on its next release.
+
+### Changed
+
+- Contract rules, hash inputs and run producers are looked up per kind from
+  registries pinned to `KINDS`.
+
 ## [0.5.0] - 2026-09-09
 
 ### Added

{continuo_python_runtime-0.5.0 → continuo_python_runtime-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: continuo-python-runtime
-Version: 0.5.0
+Version: 0.7.0
 Summary: Runtime harness, contract tooling, and CI lint for Continuo python nodes.
 Author: Simone Carolini
 Maintainer: Simone Carolini
@@ -163,7 +163,7 @@ Every rule below (`extra_columns`, `output_columns`, "Conform rules") applies
 to both kinds identically — `kind` only changes how the pre-conform table is
 produced, never how it is checked or written.
 
-- **`python-model`** (the default; the field may be omitted) — a script node.
+- **`python-node`** (the default; the field may be omitted) — a script node.
   It requires `script:` and a `reads:` map of one or more named SQL queries,
   as described in "The script API" below.
 - **`python-csv`** — a contract-only node: it has no script and its `reads:`
@@ -179,6 +179,12 @@ produced, never how it is checked or written.
   header but not declared are governed by the same `extra_columns` policy as
   a script node's output — `raise` (default) fails the run, `warn` drops
   them and logs a warning. See `template/contracts/example_csv.yml`.
+- **`python-api`** — a script node that fetches its own data (typically over
+  HTTP) and declares no `reads:`. `ctx.read` has nothing to return. It may name
+  one Kubernetes Secret with `secret_ref: continuo-api-<name>`; continuo
+  attaches that Secret to the node's pod, so each of its keys is an env var the
+  script reads with `os.environ[...]`. The contract never holds a secret value
+  or env var name; the Secret itself is created in the cluster by the operator.
 
 ## The script API
 
@@ -275,9 +281,9 @@ A domain repo picks its warehouse engine by which base image it builds
 `FROM`:
 
 ```dockerfile
-FROM ghcr.io/carolsimone/continuo-python-runtime-postgres:v0.5.0
+FROM ghcr.io/carolsimone/continuo-python-runtime-postgres:v0.7.0
 # or
-FROM ghcr.io/carolsimone/continuo-python-runtime-trino:v0.5.0
+FROM ghcr.io/carolsimone/continuo-python-runtime-trino:v0.7.0
 ```
 
 The engine is part of the image **name**; the tag is the bare version, so

{continuo_python_runtime-0.5.0 → continuo_python_runtime-0.7.0}/README.md

@@ -143,7 +143,7 @@ Every rule below (`extra_columns`, `output_columns`, "Conform rules") applies
 to both kinds identically — `kind` only changes how the pre-conform table is
 produced, never how it is checked or written.
 
-- **`python-model`** (the default; the field may be omitted) — a script node.
+- **`python-node`** (the default; the field may be omitted) — a script node.
   It requires `script:` and a `reads:` map of one or more named SQL queries,
   as described in "The script API" below.
 - **`python-csv`** — a contract-only node: it has no script and its `reads:`
@@ -159,6 +159,12 @@ produced, never how it is checked or written.
   header but not declared are governed by the same `extra_columns` policy as
   a script node's output — `raise` (default) fails the run, `warn` drops
   them and logs a warning. See `template/contracts/example_csv.yml`.
+- **`python-api`** — a script node that fetches its own data (typically over
+  HTTP) and declares no `reads:`. `ctx.read` has nothing to return. It may name
+  one Kubernetes Secret with `secret_ref: continuo-api-<name>`; continuo
+  attaches that Secret to the node's pod, so each of its keys is an env var the
+  script reads with `os.environ[...]`. The contract never holds a secret value
+  or env var name; the Secret itself is created in the cluster by the operator.
 
 ## The script API
 
@@ -255,9 +261,9 @@ A domain repo picks its warehouse engine by which base image it builds
 `FROM`:
 
 ```dockerfile
-FROM ghcr.io/carolsimone/continuo-python-runtime-postgres:v0.5.0
+FROM ghcr.io/carolsimone/continuo-python-runtime-postgres:v0.7.0
 # or
-FROM ghcr.io/carolsimone/continuo-python-runtime-trino:v0.5.0
+FROM ghcr.io/carolsimone/continuo-python-runtime-trino:v0.7.0
 ```
 
 The engine is part of the image **name**; the tag is the bare version, so

{continuo_python_runtime-0.5.0 → continuo_python_runtime-0.7.0}/adapters/postgres/pyproject.toml

@@ -1,5 +1,5 @@
 [project]
-version = "0.2.1"
+version = "0.2.2"
 name = "continuo-postgres-adapter"
 description = "Postgres warehouse adapter for Continuo: validation and python-node runtime."
 authors = [{ name = "Simone Carolini" }]

{continuo_python_runtime-0.5.0 → continuo_python_runtime-0.7.0}/adapters/postgres/tests/conftest.py

@@ -43,8 +43,18 @@ def minio_container():
                 "-p", "0:9000",
                 "-e", "MINIO_ROOT_USER=minioadmin",
                 "-e", "MINIO_ROOT_PASSWORD=minioadmin",
-                "minio/minio:latest",
-                "server", "/data", "--address", ":9000",
+                # ghcr mirror of Bitnami's minio image (Docker Hub's minio/minio
+                # is no longer anonymously pullable). Its ENTRYPOINT is
+                # Bitnami's own setup script, not the `minio` binary, so it
+                # must be overridden for these args to reach `minio` directly;
+                # its data dir also has to be Bitnami's own
+                # /bitnami/minio/data (world-root-group-writable for the
+                # image's non-root user) since plain /data doesn't exist in
+                # this image and the binary can't create it at the
+                # filesystem root.
+                "--entrypoint", "minio",
+                "ghcr.io/carolsimone/continuo-minio:2025.7.23",
+                "server", "/bitnami/minio/data", "--address", ":9000",
             ],
             check=True, capture_output=True, text=True, timeout=60,
         )

{continuo_python_runtime-0.5.0 → continuo_python_runtime-0.7.0}/adapters/postgres/tests/test_integration_runtime_postgres.py

@@ -354,7 +354,7 @@ def test_run_node_csv_kind_loads_minio_csv_into_postgres(clean_schema, csv_minio
     doubles here -- the S3CsvSourceReader from csv_readers.reader_for talks
     to the real minio container, and PostgresAdapter writes to the real
     postgres stack), then conform()/ensure_table()/load() proceed exactly as
-    for a python-model node.
+    for a python-node node.
     """
     monkeypatch.setenv("S3_ENDPOINT_URL", csv_minio)
     repo = _csv_contract_dir(tmp_path, clean_schema)

continuo_python_runtime-0.7.0/continuo_python_runtime/contract/kinds.py

@@ -0,0 +1,124 @@
+"""Per-kind contract rules: which fields a node of each kind must carry.
+
+Each kind is one ``KindRules`` entry composed of a script policy, a reads rule,
+and whether it may name a Secret. Adding a kind means adding one entry to
+``RULES``; nothing that parses a contract branches on the kind's name.
+"""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+from dataclasses import dataclass
+from typing import Any
+
+from continuo_engine_contract.sql import ensure_single_read  # type: ignore[import-untyped]
+from sqlglot.errors import TokenError
+
+from continuo_python_runtime.contract.model import KINDS
+from continuo_python_runtime.csv_source import parse_csv_uri
+from continuo_python_runtime.errors import ContractError
+
+
+class ReadsRule(ABC):
+    """Validates a node's ``reads`` mapping and returns it unchanged."""
+
+    @abstractmethod
+    def validate(
+        self, reads: Any, label: str, *, dialect: str | None, check_reads: bool
+    ) -> dict[str, str]: ...
+
+
+class SqlReads(ReadsRule):
+    """A non-empty mapping of read name -> single SELECT."""
+
+    def validate(
+        self, reads: Any, label: str, *, dialect: str | None, check_reads: bool
+    ) -> dict[str, str]:
+        if not isinstance(reads, dict) or not reads:
+            raise ContractError(
+                f"{label}: 'reads' must be a non-empty mapping of name -> SQL"
+            )
+        for name, sql in reads.items():
+            if not isinstance(name, str) or not name.strip():
+                raise ContractError(
+                    f"{label}: 'reads' name {name!r} must be a non-empty string"
+                )
+            if not isinstance(sql, str) or not sql.strip():
+                raise ContractError(
+                    f"{label}: 'reads.{name}' must be a non-empty SQL string"
+                )
+            if not check_reads:
+                continue
+            try:
+                ensure_single_read(sql, dialect)
+            except (ValueError, TokenError) as exc:
+                # ensure_single_read's own message is phrased for check_binds
+                # (its only other caller today), so it's wrapped rather than
+                # surfaced bare here. TokenError is also caught: an unterminated
+                # string literal or comment fails sqlglot's tokenizer with a
+                # TokenError, a SqlglotError sibling of ParseError and not a
+                # subclass of ValueError -- despite ensure_single_read's
+                # docstring promising every rejection is a ValueError. Only
+                # TokenError, not the broader SqlglotError, is caught here: by
+                # the time control reaches this point `dialect` has already
+                # been validated once in load_contract_dir, so any other
+                # SqlglotError a future sqlglot version might raise from this
+                # call should surface as itself, not get relabeled as a
+                # rejected read.
+                raise ContractError(
+                    f"{label}: 'reads.{name}' must be a single read query ({exc})"
+                ) from exc
+        return dict(reads)
+
+
+class CsvRead(ReadsRule):
+    """Exactly ``{csv: <uri>}``, the uri in the grammar ``parse_csv_uri`` accepts."""
+
+    def validate(
+        self, reads: Any, label: str, *, dialect: str | None, check_reads: bool
+    ) -> dict[str, str]:
+        if not isinstance(reads, dict) or set(reads) != {"csv"}:
+            raise ContractError(
+                f"{label}: a python-csv node's 'reads' must be exactly {{csv: <uri>}}"
+            )
+        try:
+            parse_csv_uri(reads["csv"])
+        except (ValueError, TypeError) as exc:
+            raise ContractError(f"{label}: invalid csv uri: {exc}") from exc
+        return dict(reads)
+
+
+class NoReads(ReadsRule):
+    """No declared reads: the node's script fetches its own data."""
+
+    def validate(
+        self, reads: Any, label: str, *, dialect: str | None, check_reads: bool
+    ) -> dict[str, str]:
+        if reads is None or (isinstance(reads, dict) and not reads):
+            return {}
+        raise ContractError(
+            f"{label}: a python-api node declares no 'reads' (its script fetches its own data)"
+        )
+
+
+@dataclass(frozen=True)
+class KindRules:
+    """What a node of one kind must declare."""
+
+    script_required: bool
+    reads: ReadsRule
+    secret_allowed: bool = False
+
+
+RULES: dict[str, KindRules] = {
+    "python-node": KindRules(script_required=True, reads=SqlReads()),
+    "python-csv": KindRules(script_required=False, reads=CsvRead()),
+    "python-api": KindRules(script_required=True, reads=NoReads(), secret_allowed=True),
+}
+
+
+def rules_for(kind: object, label: str) -> KindRules:
+    """Return the rules for ``kind``; raise ``ContractError`` for any other value."""
+    if isinstance(kind, str) and kind in RULES:
+        return RULES[kind]
+    raise ContractError(f"{label}: 'kind' must be one of {sorted(KINDS)}, got {kind!r}")

{continuo_python_runtime-0.5.0 → continuo_python_runtime-0.7.0}/continuo_python_runtime/contract/loader.py

@@ -11,18 +11,17 @@ from pathlib import Path
 from typing import Any
 
 import yaml
-from continuo_engine_contract.sql import ensure_single_read  # type: ignore[import-untyped]
 from sqlglot import Dialect
-from sqlglot.errors import TokenError
 
+from continuo_python_runtime.contract.kinds import rules_for
 from continuo_python_runtime.contract.model import (
     CRITICALITIES,
+    DEFAULT_KIND,
     EXTRA_COLUMNS_POLICIES,
-    KINDS,
     Column,
     Node,
 )
-from continuo_python_runtime.csv_source import parse_csv_uri
+from continuo_python_runtime.contract.secret_ref import validate_secret_ref
 from continuo_python_runtime.errors import ContractError
 from continuo_python_runtime.types import parse_sql_type
 
@@ -40,6 +39,7 @@ _ALLOWED_KEYS = {
     "output_columns",
     "config",
     "content_hash",
+    "secret_ref",
 }
 
 _REQUIRED_STRING_FIELDS = ("schema", "table", "owner", "schedule")
@@ -173,11 +173,8 @@ def parse_node(
     if unknown:
         raise ContractError(f"{label}: unknown key(s) {sorted(unknown)}")
 
-    kind = raw.get("kind", "python-model")
-    if not isinstance(kind, str) or kind not in KINDS:
-        raise ContractError(
-            f"{label}: 'kind' must be one of {sorted(KINDS)}, got {kind!r}"
-        )
+    kind = raw.get("kind", DEFAULT_KIND)
+    rules = rules_for(kind, label)
 
     for field in _REQUIRED_STRING_FIELDS:
         value = raw.get(field)
@@ -191,20 +188,20 @@ def parse_node(
     owner = raw["owner"]
     schedule = raw["schedule"]
 
-    if kind == "python-csv":
-        if "script" in raw:
-            raise ContractError(
-                f"{label}: 'script' is forbidden for kind python-csv "
-                "(csv nodes are contract-only)"
-            )
-        script = ""
-    else:
+    if rules.script_required:
         raw_script = raw.get("script")
         if not isinstance(raw_script, str) or not raw_script.strip():
             raise ContractError(
                 f"{label}: required field 'script' must be a non-empty string"
             )
         script = raw_script
+    else:
+        if "script" in raw:
+            raise ContractError(
+                f"{label}: 'script' is forbidden for kind {kind} "
+                "(it is a contract-only kind)"
+            )
+        script = ""
 
     criticality = raw.get("criticality")
     if not isinstance(criticality, str) or criticality not in CRITICALITIES:
@@ -222,51 +219,15 @@ def parse_node(
             f"got {extra_columns!r}"
         )
 
-    reads = raw.get("reads")
-    if kind == "python-csv":
-        if not isinstance(reads, dict) or set(reads) != {"csv"}:
-            raise ContractError(
-                f"{label}: a python-csv node's 'reads' must be exactly {{csv: <uri>}}"
-            )
-        try:
-            parse_csv_uri(reads["csv"])
-        except (ValueError, TypeError) as exc:
-            raise ContractError(f"{label}: invalid csv uri: {exc}") from exc
-    else:
-        if not isinstance(reads, dict) or not reads:
-            raise ContractError(
-                f"{label}: 'reads' must be a non-empty mapping of name -> SQL"
-            )
-        for name, sql in reads.items():
-            if not isinstance(name, str) or not name.strip():
-                raise ContractError(
-                    f"{label}: 'reads' name {name!r} must be a non-empty string"
-                )
-            if not isinstance(sql, str) or not sql.strip():
-                raise ContractError(
-                    f"{label}: 'reads.{name}' must be a non-empty SQL string"
-                )
-            if not check_reads:
-                continue
-            try:
-                ensure_single_read(sql, dialect)
-            except (ValueError, TokenError) as exc:
-                # ensure_single_read's own message is phrased for check_binds
-                # (its only other caller today), so it's wrapped rather than
-                # surfaced bare here. TokenError is also caught: an unterminated
-                # string literal or comment fails sqlglot's tokenizer with a
-                # TokenError, a SqlglotError sibling of ParseError and not a
-                # subclass of ValueError -- despite ensure_single_read's
-                # docstring promising every rejection is a ValueError. Only
-                # TokenError, not the broader SqlglotError, is caught here: by
-                # the time control reaches this point `dialect` has already
-                # been validated once in load_contract_dir, so any other
-                # SqlglotError a future sqlglot version might raise from this
-                # call should surface as itself, not get relabeled as a
-                # rejected read.
-                raise ContractError(
-                    f"{label}: 'reads.{name}' must be a single read query ({exc})"
-                ) from exc
+    reads = rules.reads.validate(
+        raw.get("reads"), label, dialect=dialect, check_reads=check_reads
+    )
+
+    secret_ref = ""
+    if "secret_ref" in raw:
+        if not rules.secret_allowed:
+            raise ContractError(f"{label}: 'secret_ref' is not allowed for kind {kind}")
+        secret_ref = validate_secret_ref(raw["secret_ref"], label)
 
     raw_columns = raw.get("output_columns")
     if not isinstance(raw_columns, list) or not raw_columns:
@@ -325,13 +286,14 @@ def parse_node(
         schedule=schedule,
         criticality=criticality,
         script=script,
-        reads=dict(reads),
+        reads=reads,
         output_columns=tuple(columns),
         description=description,
         extra_columns=extra_columns,
         config=config,
         content_hash=content_hash,
         kind=kind,
+        secret_ref=secret_ref,
     )
 
 

{continuo_python_runtime-0.5.0 → continuo_python_runtime-0.7.0}/continuo_python_runtime/contract/merge.py

@@ -1,5 +1,6 @@
 """Contract v1 merger: wire contract builder."""
 
+from collections.abc import Callable
 from pathlib import Path
 
 import yaml
@@ -21,7 +22,7 @@ def node_entry(node: Node) -> dict:
     four (source_hash, shared_code_hash, config_hash, content_hash). The
     nullable field is always present in output_columns.
     """
-    return {
+    entry = {
         "schema": node.schema,
         "table": node.table,
         "owner": node.owner,
@@ -42,6 +43,11 @@ def node_entry(node: Node) -> dict:
         "extra_columns": node.extra_columns,
         "config": dict(node.config),
     }
+    # Only a kind that may name a Secret ever carries one; emitting the key
+    # only when set keeps every other node's config_hash unchanged.
+    if node.secret_ref:
+        entry["secret_ref"] = node.secret_ref
+    return entry
 
 
 def _lint_node_closure(
@@ -110,6 +116,30 @@ def _lint_node_closure(
         )
 
 
+def _script_hash_inputs(node: Node, repo_root: Path) -> tuple[bytes, list[bytes]]:
+    """A script node's source is its script plus its in-repo import closure,
+    every file of which is held to the closure lint."""
+    script_path = resolve_script_path(node.script, repo_root, context=node.relation)
+    script_bytes = script_path.read_bytes()
+    closure = resolve_closure(script_path, repo_root)
+    member_bytes = [member.read_bytes() for member in closure]
+    _lint_node_closure(node, repo_root, script_path, script_bytes, closure, member_bytes)
+    return script_bytes, member_bytes
+
+
+def _csv_hash_inputs(node: Node, repo_root: Path) -> tuple[bytes, list[bytes]]:
+    """A csv node has no script and no import closure: its source is the uri.
+    New file content at the same uri is new data, not a new node version."""
+    return node.reads["csv"].encode(), []
+
+
+_HASH_INPUTS: dict[str, Callable[[Node, Path], tuple[bytes, list[bytes]]]] = {
+    "python-node": _script_hash_inputs,
+    "python-csv": _csv_hash_inputs,
+    "python-api": _script_hash_inputs,
+}
+
+
 def build_wire_contract(
     contract_dir: Path, repo_root: Path, service: str, *, dialect: str | None = None
 ) -> dict:
@@ -129,19 +159,8 @@ def build_wire_contract(
     for node in nodes:
         entry = node_entry(node)
 
-        if node.kind == "python-csv":
-            # A csv node has no script and no import closure: its source IS
-            # the uri -- new file content at the same uri is new data, not a
-            # new node version.
-            uri_bytes = node.reads["csv"].encode()
-            entry.update(hash_parts(entry, uri_bytes, []))
-        else:
-            script_path = resolve_script_path(node.script, repo_root, context=node.relation)
-            script_bytes = script_path.read_bytes()
-            closure = resolve_closure(script_path, repo_root)
-            member_bytes = [member.read_bytes() for member in closure]
-            _lint_node_closure(node, repo_root, script_path, script_bytes, closure, member_bytes)
-            entry.update(hash_parts(entry, script_bytes, member_bytes))
+        primary_bytes, member_bytes = _HASH_INPUTS[node.kind](node, repo_root)
+        entry.update(hash_parts(entry, primary_bytes, member_bytes))
 
         wire_nodes.append(entry)
 

{continuo_python_runtime-0.5.0 → continuo_python_runtime-0.7.0}/continuo_python_runtime/contract/model.py

@@ -6,7 +6,8 @@ from typing import Any
 # Module-level constants
 CRITICALITIES = frozenset({"REGULATORY", "CORE", "SECONDARY"})
 EXTRA_COLUMNS_POLICIES = frozenset({"raise", "warn"})
-KINDS = frozenset({"python-model", "python-csv"})
+KINDS = frozenset({"python-node", "python-csv", "python-api"})
+DEFAULT_KIND = "python-node"
 CONTRACT_VERSION = 1
 
 
@@ -35,7 +36,8 @@ class Node:
     extra_columns: str = "raise"
     config: dict[str, Any] = field(default_factory=dict)
     content_hash: str | None = None
-    kind: str = "python-model"
+    kind: str = DEFAULT_KIND
+    secret_ref: str = ""
 
     @property
     def relation(self) -> str:

continuo_python_runtime-0.7.0/continuo_python_runtime/contract/secret_ref.py

@@ -0,0 +1,31 @@
+"""The name of the Kubernetes Secret a node's pod receives as env vars.
+
+The ``continuo-api-`` prefix keeps a contract from naming any other Secret in
+the namespace (the warehouse credentials, the platform's own credentials).
+continuo's topology-controller and execution-controller enforce the same
+pattern; this check gives the author the error in CI instead.
+"""
+
+from __future__ import annotations
+
+import re
+
+from continuo_python_runtime.errors import ContractError
+
+SECRET_REF_PATTERN = re.compile(r"^continuo-api-[a-z0-9]([-a-z0-9]*[a-z0-9])?$")
+SECRET_REF_MAX_LEN = 253
+
+
+def validate_secret_ref(value: object, label: str) -> str:
+    """Return ``value`` if it is a valid ``continuo-api-*`` Secret name."""
+    if (
+        not isinstance(value, str)
+        or len(value) > SECRET_REF_MAX_LEN
+        or not SECRET_REF_PATTERN.fullmatch(value)
+    ):
+        raise ContractError(
+            f"{label}: 'secret_ref' must be a Kubernetes Secret name starting with "
+            f"'continuo-api-' (lowercase letters, digits, '-'; at most "
+            f"{SECRET_REF_MAX_LEN} chars), got {value!r}"
+        )
+    return value

{continuo_python_runtime-0.5.0 → continuo_python_runtime-0.7.0}/continuo_python_runtime/harness.py

@@ -1,6 +1,6 @@
 """Container entrypoint: dispatches a single node's script and writes its output.
 
-``run_node`` is the sole write sink for a python-model node. It resolves the
+``run_node`` is the sole write sink for a python node. It resolves the
 node from the contract, loads and executes its script inside a
 :class:`~continuo_python_runtime.context.RunContext`, conforms the result to
 the declared schema, and writes it through the runtime adapter. Exactly one
@@ -16,7 +16,7 @@ import logging
 import os
 import sys
 import uuid
-from collections.abc import Mapping
+from collections.abc import Callable, Mapping
 from pathlib import Path
 from types import ModuleType
 from typing import Any
@@ -208,15 +208,37 @@ def _validate_config_early(adapter: Any, node: Node) -> None:
         ) from exc
 
 
+def _produce_from_script(
+    node: Node, adapter: Any, app_root: Path, reader: CsvSourceReader | None
+) -> Any:
+    """Import the node's script and return its ``run(ctx)`` result as Arrow."""
+    with contextlib.redirect_stdout(sys.stderr):
+        module = load_script(node, app_root)
+    ctx = RunContext(node, adapter)
+    return to_arrow(_execute_script(module, ctx))
+
+
+def _produce_from_csv(
+    node: Node, adapter: Any, app_root: Path, reader: CsvSourceReader | None
+) -> Any:
+    """Load the node's declared csv source."""
+    return produce_csv(node, reader=reader)
+
+
+_PRODUCERS: dict[str, Callable[[Node, Any, Path, CsvSourceReader | None], Any]] = {
+    "python-node": _produce_from_script,
+    "python-api": _produce_from_script,
+    "python-csv": _produce_from_csv,
+}
+
+
 def run_node(
     env: Mapping[str, str], adapter: Any = None, reader: CsvSourceReader | None = None
 ) -> int:
     """Run a single node end-to-end and print exactly one sentinel result block.
 
-    ``reader`` mirrors the ``adapter`` injection seam: when given, it is
-    threaded into :func:`produce_csv` for a python-csv node instead of
-    letting that function pick a reader via ``reader_for``. Ignored for a
-    python-model node.
+    ``reader`` is threaded into the python-csv producer instead of letting
+    it pick a reader via ``reader_for``; the script producer ignores it.
 
     Returns 0 on success, 1 on any :class:`HarnessError`.
     """
@@ -255,14 +277,7 @@ def run_node(
 
         _validate_config_early(active_adapter, node)
 
-        if node.kind == "python-csv":
-            table = produce_csv(node, reader=reader)
-        else:
-            with contextlib.redirect_stdout(sys.stderr):
-                module = load_script(node, app_root)
-            ctx = RunContext(node, active_adapter)
-            raw_result = _execute_script(module, ctx)
-            table = to_arrow(raw_result)
+        table = _PRODUCERS[node.kind](node, active_adapter, app_root, reader)
 
         conformed = conform(table, node.output_columns, node.extra_columns)