continuo-python-runtime 0.6.0__tar.gz → 0.7.0__tar.gz

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/CHANGELOG.md

@@ -5,6 +5,15 @@ follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-09-29
+
+### Added
+
+- `python-api` node kind: a script node with no declared reads. It may name a
+  Kubernetes Secret with `secret_ref` (must match `continuo-api-*`), which
+  continuo attaches to the node's pod as env vars. `secret_ref` is rejected on
+  every other kind. Existing contracts and their content hashes are unchanged.
+
 ## [0.6.0] - 2026-09-28
 
 ### Breaking

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: continuo-python-runtime
-Version: 0.6.0
+Version: 0.7.0
 Summary: Runtime harness, contract tooling, and CI lint for Continuo python nodes.
 Author: Simone Carolini
 Maintainer: Simone Carolini
@@ -179,6 +179,12 @@ produced, never how it is checked or written.
   header but not declared are governed by the same `extra_columns` policy as
   a script node's output — `raise` (default) fails the run, `warn` drops
   them and logs a warning. See `template/contracts/example_csv.yml`.
+- **`python-api`** — a script node that fetches its own data (typically over
+  HTTP) and declares no `reads:`. `ctx.read` has nothing to return. It may name
+  one Kubernetes Secret with `secret_ref: continuo-api-<name>`; continuo
+  attaches that Secret to the node's pod, so each of its keys is an env var the
+  script reads with `os.environ[...]`. The contract never holds a secret value
+  or env var name; the Secret itself is created in the cluster by the operator.
 
 ## The script API
 
@@ -275,9 +281,9 @@ A domain repo picks its warehouse engine by which base image it builds
 `FROM`:
 
 ```dockerfile
-FROM ghcr.io/carolsimone/continuo-python-runtime-postgres:v0.6.0
+FROM ghcr.io/carolsimone/continuo-python-runtime-postgres:v0.7.0
 # or
-FROM ghcr.io/carolsimone/continuo-python-runtime-trino:v0.6.0
+FROM ghcr.io/carolsimone/continuo-python-runtime-trino:v0.7.0
 ```
 
 The engine is part of the image **name**; the tag is the bare version, so

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/README.md

@@ -159,6 +159,12 @@ produced, never how it is checked or written.
   header but not declared are governed by the same `extra_columns` policy as
   a script node's output — `raise` (default) fails the run, `warn` drops
   them and logs a warning. See `template/contracts/example_csv.yml`.
+- **`python-api`** — a script node that fetches its own data (typically over
+  HTTP) and declares no `reads:`. `ctx.read` has nothing to return. It may name
+  one Kubernetes Secret with `secret_ref: continuo-api-<name>`; continuo
+  attaches that Secret to the node's pod, so each of its keys is an env var the
+  script reads with `os.environ[...]`. The contract never holds a secret value
+  or env var name; the Secret itself is created in the cluster by the operator.
 
 ## The script API
 
@@ -255,9 +261,9 @@ A domain repo picks its warehouse engine by which base image it builds
 `FROM`:
 
 ```dockerfile
-FROM ghcr.io/carolsimone/continuo-python-runtime-postgres:v0.6.0
+FROM ghcr.io/carolsimone/continuo-python-runtime-postgres:v0.7.0
 # or
-FROM ghcr.io/carolsimone/continuo-python-runtime-trino:v0.6.0
+FROM ghcr.io/carolsimone/continuo-python-runtime-trino:v0.7.0
 ```
 
 The engine is part of the image **name**; the tag is the bare version, so

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/continuo_python_runtime/contract/kinds.py

@@ -1,8 +1,8 @@
 """Per-kind contract rules: which fields a node of each kind must carry.
 
-Each kind is one ``KindRules`` entry composed of a script policy and a reads
-rule. Adding a kind means adding one entry to ``RULES``; nothing that parses a
-contract branches on the kind's name.
+Each kind is one ``KindRules`` entry composed of a script policy, a reads rule,
+and whether it may name a Secret. Adding a kind means adding one entry to
+``RULES``; nothing that parses a contract branches on the kind's name.
 """
 
 from __future__ import annotations
@@ -88,17 +88,32 @@ class CsvRead(ReadsRule):
         return dict(reads)
 
 
+class NoReads(ReadsRule):
+    """No declared reads: the node's script fetches its own data."""
+
+    def validate(
+        self, reads: Any, label: str, *, dialect: str | None, check_reads: bool
+    ) -> dict[str, str]:
+        if reads is None or (isinstance(reads, dict) and not reads):
+            return {}
+        raise ContractError(
+            f"{label}: a python-api node declares no 'reads' (its script fetches its own data)"
+        )
+
+
 @dataclass(frozen=True)
 class KindRules:
     """What a node of one kind must declare."""
 
     script_required: bool
     reads: ReadsRule
+    secret_allowed: bool = False
 
 
 RULES: dict[str, KindRules] = {
     "python-node": KindRules(script_required=True, reads=SqlReads()),
     "python-csv": KindRules(script_required=False, reads=CsvRead()),
+    "python-api": KindRules(script_required=True, reads=NoReads(), secret_allowed=True),
 }
 
 

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/continuo_python_runtime/contract/loader.py

@@ -21,6 +21,7 @@ from continuo_python_runtime.contract.model import (
     Column,
     Node,
 )
+from continuo_python_runtime.contract.secret_ref import validate_secret_ref
 from continuo_python_runtime.errors import ContractError
 from continuo_python_runtime.types import parse_sql_type
 
@@ -38,6 +39,7 @@ _ALLOWED_KEYS = {
     "output_columns",
     "config",
     "content_hash",
+    "secret_ref",
 }
 
 _REQUIRED_STRING_FIELDS = ("schema", "table", "owner", "schedule")
@@ -221,6 +223,12 @@ def parse_node(
         raw.get("reads"), label, dialect=dialect, check_reads=check_reads
     )
 
+    secret_ref = ""
+    if "secret_ref" in raw:
+        if not rules.secret_allowed:
+            raise ContractError(f"{label}: 'secret_ref' is not allowed for kind {kind}")
+        secret_ref = validate_secret_ref(raw["secret_ref"], label)
+
     raw_columns = raw.get("output_columns")
     if not isinstance(raw_columns, list) or not raw_columns:
         raise ContractError(f"{label}: 'output_columns' must be a non-empty list")
@@ -285,6 +293,7 @@ def parse_node(
         config=config,
         content_hash=content_hash,
         kind=kind,
+        secret_ref=secret_ref,
     )
 
 

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/continuo_python_runtime/contract/merge.py

@@ -22,7 +22,7 @@ def node_entry(node: Node) -> dict:
     four (source_hash, shared_code_hash, config_hash, content_hash). The
     nullable field is always present in output_columns.
     """
-    return {
+    entry = {
         "schema": node.schema,
         "table": node.table,
         "owner": node.owner,
@@ -43,6 +43,11 @@ def node_entry(node: Node) -> dict:
         "extra_columns": node.extra_columns,
         "config": dict(node.config),
     }
+    # Only a kind that may name a Secret ever carries one; emitting the key
+    # only when set keeps every other node's config_hash unchanged.
+    if node.secret_ref:
+        entry["secret_ref"] = node.secret_ref
+    return entry
 
 
 def _lint_node_closure(
@@ -131,6 +136,7 @@ def _csv_hash_inputs(node: Node, repo_root: Path) -> tuple[bytes, list[bytes]]:
 _HASH_INPUTS: dict[str, Callable[[Node, Path], tuple[bytes, list[bytes]]]] = {
     "python-node": _script_hash_inputs,
     "python-csv": _csv_hash_inputs,
+    "python-api": _script_hash_inputs,
 }
 
 

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/continuo_python_runtime/contract/model.py

@@ -6,7 +6,7 @@ from typing import Any
 # Module-level constants
 CRITICALITIES = frozenset({"REGULATORY", "CORE", "SECONDARY"})
 EXTRA_COLUMNS_POLICIES = frozenset({"raise", "warn"})
-KINDS = frozenset({"python-node", "python-csv"})
+KINDS = frozenset({"python-node", "python-csv", "python-api"})
 DEFAULT_KIND = "python-node"
 CONTRACT_VERSION = 1
 
@@ -37,6 +37,7 @@ class Node:
     config: dict[str, Any] = field(default_factory=dict)
     content_hash: str | None = None
     kind: str = DEFAULT_KIND
+    secret_ref: str = ""
 
     @property
     def relation(self) -> str:

continuo_python_runtime-0.7.0/continuo_python_runtime/contract/secret_ref.py

@@ -0,0 +1,31 @@
+"""The name of the Kubernetes Secret a node's pod receives as env vars.
+
+The ``continuo-api-`` prefix keeps a contract from naming any other Secret in
+the namespace (the warehouse credentials, the platform's own credentials).
+continuo's topology-controller and execution-controller enforce the same
+pattern; this check gives the author the error in CI instead.
+"""
+
+from __future__ import annotations
+
+import re
+
+from continuo_python_runtime.errors import ContractError
+
+SECRET_REF_PATTERN = re.compile(r"^continuo-api-[a-z0-9]([-a-z0-9]*[a-z0-9])?$")
+SECRET_REF_MAX_LEN = 253
+
+
+def validate_secret_ref(value: object, label: str) -> str:
+    """Return ``value`` if it is a valid ``continuo-api-*`` Secret name."""
+    if (
+        not isinstance(value, str)
+        or len(value) > SECRET_REF_MAX_LEN
+        or not SECRET_REF_PATTERN.fullmatch(value)
+    ):
+        raise ContractError(
+            f"{label}: 'secret_ref' must be a Kubernetes Secret name starting with "
+            f"'continuo-api-' (lowercase letters, digits, '-'; at most "
+            f"{SECRET_REF_MAX_LEN} chars), got {value!r}"
+        )
+    return value

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/continuo_python_runtime/harness.py

@@ -1,6 +1,6 @@
 """Container entrypoint: dispatches a single node's script and writes its output.
 
-``run_node`` is the sole write sink for a python-node node. It resolves the
+``run_node`` is the sole write sink for a python node. It resolves the
 node from the contract, loads and executes its script inside a
 :class:`~continuo_python_runtime.context.RunContext`, conforms the result to
 the declared schema, and writes it through the runtime adapter. Exactly one
@@ -227,6 +227,7 @@ def _produce_from_csv(
 
 _PRODUCERS: dict[str, Callable[[Node, Any, Path, CsvSourceReader | None], Any]] = {
     "python-node": _produce_from_script,
+    "python-api": _produce_from_script,
     "python-csv": _produce_from_csv,
 }
 

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/docs/boundary-contract.md

@@ -52,6 +52,15 @@ s3://<bucket>/<service>/<release_id>/contract.yaml
   release gate on a missing declared column exactly as a script node fails
   it on a missing bind. §13.4 below still applies unchanged to
   `kind: python-node` nodes.
+- **`python-api`** is the third `kind`: a script-backed node, like
+  `python-node`, that declares no reads and may name a Kubernetes Secret
+  through an optional `secret_ref` (must match `continuo-api-*`; a trailing
+  newline is rejected). Only this kind may set it. Its script and import closure are hashed and
+  linted exactly as for `python-node`. When `secret_ref` is set, it appears
+  on the merged wire entry as an extra key (absent otherwise, so no other
+  node's wire entry or `config_hash` changes), and it is part of
+  `config_hash`, so `content_hash` changes when the referenced Secret name
+  changes. `source_hash` does not.
 - **Reads must be single-statement SELECTs with every table reference
   schema-qualified** (`analytics.table_a`, never `table_a`) — the resolver
   raises `UnqualifiedTableReference` and rejects the whole release otherwise

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/image-requirements-postgres.txt

@@ -1,2 +1,2 @@
-continuo-python-runtime==0.6.0
+continuo-python-runtime==0.7.0
 continuo-postgres-adapter==0.2.2

continuo_python_runtime-0.7.0/image-requirements-trino.txt

@@ -0,0 +1,2 @@
+continuo-python-runtime==0.7.0
+continuo-trino-adapter==0.2.1

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "continuo-python-runtime"
-version = "0.6.0"
+version = "0.7.0"
 description = "Runtime harness, contract tooling, and CI lint for Continuo python nodes."
 authors = [{ name = "Simone Carolini" }]
 maintainers = [{ name = "Simone Carolini" }]

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/template/Dockerfile

@@ -1,5 +1,5 @@
 # Tags are v<version>; one image per engine (continuo-python-runtime-postgres / -trino).
-FROM ghcr.io/carolsimone/continuo-python-runtime-postgres:v0.6.0
+FROM ghcr.io/carolsimone/continuo-python-runtime-postgres:v0.7.0
 COPY contracts/ /app/contracts/
 COPY scripts/ /app/scripts/
 # COPY every OTHER directory your scripts import from, too. CI folds a script's

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/tests/contract/test_kinds.py

@@ -1,7 +1,8 @@
 import pytest
 
-from continuo_python_runtime.contract.kinds import RULES, CsvRead, SqlReads, rules_for
+from continuo_python_runtime.contract.kinds import RULES, CsvRead, NoReads, SqlReads, rules_for
 from continuo_python_runtime.contract.model import KINDS
+from continuo_python_runtime.contract.secret_ref import validate_secret_ref
 from continuo_python_runtime.errors import ContractError
 
 
@@ -45,3 +46,51 @@ def test_csv_read_requires_exactly_a_csv_key():
 def test_csv_read_validates_the_uri():
     with pytest.raises(ContractError, match="invalid csv uri"):
         CsvRead().validate({"csv": "http://insecure/x.csv"}, "L", dialect=None, check_reads=True)
+
+
+def test_python_api_requires_a_script_declares_no_reads_and_may_name_a_secret():
+    rules = RULES["python-api"]
+    assert rules.script_required is True
+    assert isinstance(rules.reads, NoReads)
+    assert rules.secret_allowed is True
+
+
+def test_only_python_api_may_name_a_secret():
+    assert {k for k, r in RULES.items() if r.secret_allowed} == {"python-api"}
+
+
+@pytest.mark.parametrize("reads", [None, {}])
+def test_no_reads_accepts_absent_or_empty(reads):
+    assert NoReads().validate(reads, "L", dialect=None, check_reads=True) == {}
+
+
+@pytest.mark.parametrize("reads", [{"x": "select 1"}, {"csv": "s3://b/k"}, [], "select 1"])
+def test_no_reads_rejects_any_declared_read(reads):
+    with pytest.raises(ContractError, match="a python-api node declares no 'reads'"):
+        NoReads().validate(reads, "L", dialect=None, check_reads=True)
+
+
+@pytest.mark.parametrize(
+    "name",
+    [
+        "continuo-api-fx",
+        "continuo-api-a",
+        "continuo-api-stripe-2",
+        "continuo-api-" + "a" * 240,
+    ],
+)
+def test_secret_ref_accepts_valid_names(name):
+    assert validate_secret_ref(name, "L") == name
+
+
+@pytest.mark.parametrize(
+    "name",
+    [
+        "", "continuo-api-", "continuo-api-FX", "continuo-api--x-", "api-fx",
+        "continuo-app-credentials", "continuo-api-x_y", " continuo-api-fx",
+        "continuo-api-" + "a" * 241, "continuo-api-fx\n", 7, None,
+    ],
+)
+def test_secret_ref_rejects_invalid_names(name):
+    with pytest.raises(ContractError, match="'secret_ref'"):
+        validate_secret_ref(name, "L")

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/tests/contract/test_loader.py

@@ -682,3 +682,48 @@ def test_load_contract_dir_threads_check_reads_to_parse_node(monkeypatch, tmp_pa
     assert calls == []
     load_contract_dir(tmp_path)
     assert calls == [VALID["reads"]["ids"]]
+
+
+def _api_entry(**overrides):
+    entry = {
+        "schema": "analytics", "table": "fx", "owner": "m", "schedule": "daily",
+        "criticality": "SECONDARY", "kind": "python-api", "script": "scripts/fx.py",
+        "output_columns": [{"name": "rate", "type": "DOUBLE PRECISION"}],
+    }
+    entry.update(overrides)
+    return entry
+
+
+def test_python_api_without_reads_loads_with_empty_reads():
+    node = parse_node(_api_entry(), "c.yml")
+    assert node.kind == "python-api"
+    assert node.reads == {}
+    assert node.secret_ref == ""
+
+
+def test_python_api_with_secret_ref_keeps_it():
+    node = parse_node(_api_entry(secret_ref="continuo-api-fx"), "c.yml")
+    assert node.secret_ref == "continuo-api-fx"
+
+
+def test_python_api_with_reads_is_rejected():
+    with pytest.raises(ContractError, match="declares no 'reads'"):
+        parse_node(_api_entry(reads={"x": "select 1"}), "c.yml")
+
+
+def test_python_api_still_requires_a_script():
+    entry = _api_entry()
+    del entry["script"]
+    with pytest.raises(ContractError, match="required field 'script'"):
+        parse_node(entry, "c.yml")
+
+
+def test_secret_ref_on_python_node_is_rejected():
+    entry = _api_entry(kind="python-node", reads={"x": "select 1"}, secret_ref="continuo-api-fx")
+    with pytest.raises(ContractError, match="'secret_ref' is not allowed for kind python-node"):
+        parse_node(entry, "c.yml")
+
+
+def test_bad_secret_ref_is_rejected_naming_the_node():
+    with pytest.raises(ContractError, match=r"c\.yml \(analytics\.fx\): 'secret_ref'"):
+        parse_node(_api_entry(secret_ref="continuo-app-credentials"), "c.yml")

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/tests/contract/test_merge.py

@@ -481,3 +481,52 @@ def test_csv_node_needs_no_script_file_on_disk(tmp_path):
     )
     doc = build_wire_contract(tmp_path / "contracts", tmp_path, "svc")
     assert len(doc["nodes"]) == 1
+
+
+def _api_repo(tmp_path, **extra):
+    tmp_path.mkdir(parents=True, exist_ok=True)
+    (tmp_path / "contracts").mkdir()
+    (tmp_path / "scripts").mkdir()
+    (tmp_path / "scripts" / "fx.py").write_text(
+        "import pyarrow as pa\n\ndef run(ctx):\n    return pa.table({'rate': [1.0]})\n"
+    )
+    node = {
+        "schema": "analytics", "table": "fx", "owner": "m", "schedule": "daily",
+        "criticality": "SECONDARY", "kind": "python-api", "script": "scripts/fx.py",
+        "output_columns": [{"name": "rate", "type": "DOUBLE PRECISION"}],
+    }
+    node.update(extra)
+    (tmp_path / "contracts" / "fx.yml").write_text(yaml.safe_dump({"nodes": [node]}))
+    return tmp_path
+
+
+def test_python_api_wire_entry_has_empty_reads_and_no_secret_key_when_unset(tmp_path):
+    repo = _api_repo(tmp_path)
+    (entry,) = build_wire_contract(repo / "contracts", repo, "s")["nodes"]
+    assert set(entry) == WIRE_ENTRY_KEYS
+    assert entry["kind"] == "python-api"
+    assert entry["reads"] == {}
+    assert entry["source_hash"] == sha256((repo / "scripts" / "fx.py").read_bytes()).hexdigest()
+
+
+def test_python_api_wire_entry_carries_secret_ref_when_set(tmp_path):
+    repo = _api_repo(tmp_path, secret_ref="continuo-api-fx")
+    (entry,) = build_wire_contract(repo / "contracts", repo, "s")["nodes"]
+    assert set(entry) == WIRE_ENTRY_KEYS | {"secret_ref"}
+    assert entry["secret_ref"] == "continuo-api-fx"
+
+
+def test_secret_ref_is_part_of_the_config_hash(tmp_path):
+    a = _api_repo(tmp_path / "a", secret_ref="continuo-api-fx")
+    b = _api_repo(tmp_path / "b", secret_ref="continuo-api-other")
+    (ea,) = build_wire_contract(a / "contracts", a, "s")["nodes"]
+    (eb,) = build_wire_contract(b / "contracts", b, "s")["nodes"]
+    assert ea["source_hash"] == eb["source_hash"]
+    assert ea["config_hash"] != eb["config_hash"]
+
+
+def test_python_api_script_is_held_to_the_closure_lint(tmp_path):
+    repo = _api_repo(tmp_path)
+    (repo / "scripts" / "fx.py").write_text("import psycopg2\n\ndef run(ctx):\n    return None\n")
+    with pytest.raises(ContractError, match="lint violations"):
+        build_wire_contract(repo / "contracts", repo, "s")

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/tests/contract/test_model.py

@@ -41,5 +41,5 @@ def test_kind_accepts_python_csv():
     assert n.kind == "python-csv"
 
 
-def test_kinds_frozenset_contains_both_kinds():
-    assert KINDS == frozenset({"python-node", "python-csv"})
+def test_kinds_frozenset_contains_every_kind():
+    assert KINDS == frozenset({"python-node", "python-csv", "python-api"})

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/tests/test_contract_loader.py

@@ -33,5 +33,5 @@ def test_explicit_python_node_kind_is_accepted():
 
 
 def test_python_model_kind_is_rejected():
-    with pytest.raises(ContractError, match=r"'kind' must be one of \['python-csv', 'python-node'\], got 'python-model'"):
+    with pytest.raises(ContractError, match=r"'kind' must be one of \['python-api', 'python-csv', 'python-node'\], got 'python-model'"):
         parse_node(_base_node(kind="python-model"), "t.yml")

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/tests/test_harness.py

@@ -666,3 +666,52 @@ def test_adapter_construction_failure_emits_single_load_error_block(monkeypatch,
     out = capsys.readouterr().out
     assert out.count("===CONTINUO_VALIDATION_RESULT_BEGIN===") == 1
     assert '"message":"LoadError:' in out
+
+
+def _api_repo(tmp_path, script_body):
+    (tmp_path / "contracts").mkdir()
+    (tmp_path / "scripts").mkdir()
+    (tmp_path / "scripts" / "fx.py").write_text(script_body)
+    (tmp_path / "contracts" / "fx.yml").write_text(yaml.safe_dump({"nodes": [{
+        "schema": "analytics", "table": "fx", "owner": "m", "schedule": "daily",
+        "criticality": "SECONDARY", "kind": "python-api", "script": "scripts/fx.py",
+        "secret_ref": "continuo-api-fx",
+        "output_columns": [{"name": "rate", "type": "DOUBLE PRECISION"}],
+    }]}))
+    return tmp_path
+
+
+def _api_env(repo):
+    return {
+        "NODE_ID": "analytics.fx", "TABLE_NAME": "fx", "TARGET_SCHEMA": "analytics",
+        "CONTRACT_DIR": str(repo / "contracts"), "APP_ROOT": str(repo),
+    }
+
+
+def _sentinel_body(out):
+    return json.loads(out.split("BEGIN===\n")[1].split("\n===CONTINUO")[0])
+
+
+def test_python_api_node_runs_its_script_and_loads_the_result(tmp_path, capsys):
+    repo = _api_repo(
+        tmp_path,
+        "import pyarrow as pa\n\ndef run(ctx):\n    return pa.table({'rate': [1.08]})\n",
+    )
+    adapter = FakeWarehouseAdapter()
+    assert run_node(_api_env(repo), adapter=adapter) == 0
+    assert adapter.loaded[2].column("rate").to_pylist() == [1.08]
+    assert _sentinel_body(capsys.readouterr().out)["status"] == "success"
+
+
+def test_python_api_ctx_read_is_a_read_error(tmp_path, capsys):
+    repo = _api_repo(tmp_path, "def run(ctx):\n    return ctx.read('anything')\n")
+    assert run_node(_api_env(repo), adapter=FakeWarehouseAdapter()) == 1
+    assert "ReadError" in capsys.readouterr().out
+
+
+def test_python_api_missing_env_key_is_a_script_error_naming_the_key(tmp_path, capsys, monkeypatch):
+    monkeypatch.delenv("FX_API_KEY", raising=False)
+    repo = _api_repo(tmp_path, "import os\n\ndef run(ctx):\n    return os.environ['FX_API_KEY']\n")
+    assert run_node(_api_env(repo), adapter=FakeWarehouseAdapter()) == 1
+    out = capsys.readouterr().out
+    assert "ScriptError" in out and "FX_API_KEY" in out

{continuo_python_runtime-0.6.0 → continuo_python_runtime-0.7.0}/uv.lock

@@ -209,7 +209,7 @@ test = [
 
 [[package]]
 name = "continuo-python-runtime"
-version = "0.6.0"
+version = "0.7.0"
 source = { editable = "." }
 dependencies = [
     { name = "boto3" },

continuo_python_runtime-0.6.0/image-requirements-trino.txt

@@ -1,2 +0,0 @@
-continuo-python-runtime==0.6.0
-continuo-trino-adapter==0.2.1