detectkit 0.63.0__tar.gz → 0.65.0__tar.gz

{detectkit-0.63.0/detectkit.egg-info → detectkit-0.65.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: detectkit
-Version: 0.63.0
+Version: 0.65.0
 Summary: Metric monitoring with automatic anomaly detection
 Author: detectkit team
 License: MIT
@@ -40,11 +40,17 @@ Provides-Extra: mariadb
 Requires-Dist: pymysql>=1.0.0; extra == "mariadb"
 Provides-Extra: duckdb
 Requires-Dist: duckdb>=1.1; extra == "duckdb"
+Provides-Extra: snowflake
+Requires-Dist: snowflake-connector-python>=3.12; extra == "snowflake"
+Provides-Extra: bigquery
+Requires-Dist: google-cloud-bigquery>=3.15; extra == "bigquery"
 Provides-Extra: all-db
 Requires-Dist: clickhouse-driver>=0.2.0; extra == "all-db"
 Requires-Dist: psycopg2-binary>=2.9.0; extra == "all-db"
 Requires-Dist: pymysql>=1.0.0; extra == "all-db"
 Requires-Dist: duckdb>=1.1; extra == "all-db"
+Requires-Dist: snowflake-connector-python>=3.12; extra == "all-db"
+Requires-Dist: google-cloud-bigquery>=3.15; extra == "all-db"
 Provides-Extra: prophet
 Requires-Dist: prophet>=1.1.0; extra == "prophet"
 Provides-Extra: timesfm
@@ -61,6 +67,8 @@ Requires-Dist: clickhouse-driver>=0.2.0; extra == "all"
 Requires-Dist: psycopg2-binary>=2.9.0; extra == "all"
 Requires-Dist: pymysql>=1.0.0; extra == "all"
 Requires-Dist: duckdb>=1.1; extra == "all"
+Requires-Dist: snowflake-connector-python>=3.12; extra == "all"
+Requires-Dist: google-cloud-bigquery>=3.15; extra == "all"
 Requires-Dist: prophet>=1.1.0; extra == "all"
 Requires-Dist: timesfm>=0.1.0; extra == "all"
 Requires-Dist: sqlglot>=20.0; extra == "all"
@@ -106,7 +114,7 @@ Dynamic: license-file
 - **@mentions** — tag users/groups in alerts, each channel formats natively
 - **Alert lifecycle** — consecutive anomalies, fraction-of-window rule (`anomaly_window` + `min_anomaly_share`), cooldown, recovery notifications, no-data alerts
 - **Project-level error alerts** — catch DB outages and pipeline crashes once per run
-- **Database agnostic** — ClickHouse, PostgreSQL, MySQL/MariaDB, DuckDB (no server needed)
+- **Database agnostic** — ClickHouse, PostgreSQL, MySQL/MariaDB, DuckDB (no server needed); Snowflake and BigQuery as hybrid-mode sources
 - **Hybrid mode** — read metric SQL from a billed-per-query warehouse while all pipeline state lives in a cheap local database
 - **Idempotent** — resume from interruptions, no duplicate processing
 - **CLI** — `dtk init`, `dtk run --select`, `dtk unlock`, `dtk clean`, tag-based selectors
@@ -123,6 +131,8 @@ With database drivers:
 ```bash
 pip install detectkit[clickhouse]   # ClickHouse
 pip install detectkit[duckdb]       # DuckDB - single file, no server
+pip install detectkit[snowflake]    # Snowflake - source-only (hybrid mode)
+pip install detectkit[bigquery]     # BigQuery - source-only (hybrid mode)
 pip install detectkit[all-db]       # All databases
 ```
 

{detectkit-0.63.0 → detectkit-0.65.0}/README.md

@@ -24,7 +24,7 @@
 - **@mentions** — tag users/groups in alerts, each channel formats natively
 - **Alert lifecycle** — consecutive anomalies, fraction-of-window rule (`anomaly_window` + `min_anomaly_share`), cooldown, recovery notifications, no-data alerts
 - **Project-level error alerts** — catch DB outages and pipeline crashes once per run
-- **Database agnostic** — ClickHouse, PostgreSQL, MySQL/MariaDB, DuckDB (no server needed)
+- **Database agnostic** — ClickHouse, PostgreSQL, MySQL/MariaDB, DuckDB (no server needed); Snowflake and BigQuery as hybrid-mode sources
 - **Hybrid mode** — read metric SQL from a billed-per-query warehouse while all pipeline state lives in a cheap local database
 - **Idempotent** — resume from interruptions, no duplicate processing
 - **CLI** — `dtk init`, `dtk run --select`, `dtk unlock`, `dtk clean`, tag-based selectors
@@ -41,6 +41,8 @@ With database drivers:
 ```bash
 pip install detectkit[clickhouse]   # ClickHouse
 pip install detectkit[duckdb]       # DuckDB - single file, no server
+pip install detectkit[snowflake]    # Snowflake - source-only (hybrid mode)
+pip install detectkit[bigquery]     # BigQuery - source-only (hybrid mode)
 pip install detectkit[all-db]       # All databases
 ```
 

{detectkit-0.63.0 → detectkit-0.65.0}/detectkit/__init__.py

@@ -4,7 +4,7 @@ detectk - Anomaly Detection for Time-Series Metrics
 A Python library for data analysts and engineers to monitor metrics with automatic anomaly detection.
 """
 
-__version__ = "0.63.0"
+__version__ = "0.65.0"
 
 from detectkit.core.interval import Interval
 from detectkit.core.models import ColumnDefinition, TableModel

{detectkit-0.63.0 → detectkit-0.65.0}/detectkit/cli/assets/claude/CLAUDE.section.md

@@ -14,7 +14,7 @@ conventions.
 **Database access for _you_ (recommended, not required).** detectkit itself
 connects to the database directly via its drivers — it **never** needs an MCP to
 run. But you assist far better with **read access to the same database** (e.g. a
-database MCP for the project's ClickHouse / PostgreSQL / MySQL / MariaDB / DuckDB): you can inspect
+database MCP for the project's ClickHouse / PostgreSQL / MySQL / MariaDB / DuckDB / Snowflake / BigQuery (the last two source-only, hybrid mode)): you can inspect
 a metric's series, find real incidents to label for `dtk autotune`, sanity-check
 a metric query before running it, and confirm detections — instead of asking the
 user to run every query by hand. Without it, fall back to marking incidents

{detectkit-0.63.0 → detectkit-0.65.0}/detectkit/cli/assets/claude/rules/metrics.md

@@ -79,6 +79,9 @@ not applied at runtime by `dtk run`; `source_profile` is live). Only the
 metric's **load** step ever connects to it — detect/alert and every other
 command don't — though every `dtk run` fail-fast validates the resolved name
 up front regardless of `--steps` (a typo exits 1 before any pipeline work).
+The `source_profile` may point at a **source-only** warehouse profile such as
+`snowflake` or `bigquery` (usable *only* as a source, never for `_dtk_*` state
+— see `project.md`), which is exactly the case hybrid mode is built for.
 See the [Hybrid Mode guide](https://dtk.pipelab.dev/guides/hybrid-mode/).
 
 `ai_context` is **OSI-compatible grounding** you can add to any metric with **no

{detectkit-0.63.0 → detectkit-0.65.0}/detectkit/cli/assets/claude/rules/overview.md

@@ -6,7 +6,10 @@ metrics with automatic anomaly detection and multi-channel alerting. It is
 them with one command. Core logic is pure numpy (no pandas). **ClickHouse,
 PostgreSQL, MySQL/MariaDB and DuckDB are all fully supported** — only the
 connection and the SQL dialect of your metric queries differ between them
-(DuckDB additionally needs no server at all — just a local file).
+(DuckDB additionally needs no server at all — just a local file); **Snowflake**
+and **BigQuery** are supported as **source-only** backends (hybrid mode — they
+run a metric's load SQL, but `_dtk_*` state must live in one of the full
+backends).
 
 ## The pipeline: load → detect → alert
 

{detectkit-0.63.0 → detectkit-0.65.0}/detectkit/cli/assets/claude/rules/project.md

@@ -57,7 +57,9 @@ profile whose database runs metric SQL, while *every* `_dtk_*` table
 **state** profile — the one `dtk run` is already connected to for everything
 else. A per-metric `source_profile` overrides it (`metrics.md`); resolves
 **metric → project → unset**, same precedence as `loading_delay`. Unset on
-both = today's behavior (one profile does everything). Only the LOAD step's
+both = today's behavior (one profile does everything). The source profile can
+be a full backend **or** a **source-only** type (`snowflake`, `bigquery`) —
+valid only here, never as the state profile. Only the LOAD step's
 metric-SQL query is affected — detect/alert and every other command
 (`dtk autotune`/`tune`/`ui`/`clean`/`unlock`) only ever touch the state
 profile. A source-side failure raises `SourceDatabaseError` (message leads
@@ -137,12 +139,15 @@ alert_channels:
 
 ### Database profiles
 
-> ClickHouse, PostgreSQL, MySQL, MariaDB and DuckDB are all supported.
+> ClickHouse, PostgreSQL, MySQL, MariaDB and DuckDB are all supported as
+> **state** backends (they hold the `_dtk_*` tables); **Snowflake** and
+> **BigQuery** are **source-only** — see their blocks below.
 > ClickHouse/MySQL/MariaDB use two *databases*; PostgreSQL connects to one
 > `database` and uses two *schemas*; DuckDB is a single *file* (or `:memory:`
 > for tests) holding two *schemas*.
 > `dtk init --db-type {clickhouse,postgres,mysql,mariadb}` scaffolds the right
-> shape — DuckDB profiles are written by hand (not yet a `--db-type` choice).
+> shape — DuckDB, Snowflake and BigQuery profiles are written by hand (not yet
+> a `--db-type` choice).
 
 **ClickHouse**:
 ```yaml
@@ -215,6 +220,68 @@ profiles:
 > process restarts — use it for tests/scratch only, never a real project.
 > `pip install 'detectkit[duckdb]'`.
 
+**Snowflake** (**source-only** — hybrid mode; runs a metric's load SQL, never
+holds `_dtk_*` state):
+```yaml
+profiles:
+  warehouse:
+    type: snowflake
+    account: "{{ env_var('SNOWFLAKE_ACCOUNT') }}"   # required — e.g. ab12345.eu-central-1
+    user: svc_detectkit                             # required
+    # key-pair auth (recommended — Snowflake retires single-factor passwords for
+    # service accounts through 2026); use ONE of key-pair or password:
+    private_key_path: /etc/detectkit/snowflake.p8   # PEM private key file
+    private_key_passphrase: "{{ env_var('SNOWFLAKE_KEY_PASSPHRASE') }}"   # optional
+    # password: "{{ env_var('SNOWFLAKE_PASSWORD') }}"   # alternative to key-pair
+    warehouse: COMPUTE_WH          # required — the virtual warehouse to run on
+    database: ANALYTICS            # required — where the metric SQL reads from
+    schema: PUBLIC                 # optional — default schema (aliases schema_name)
+    role: DETECTKIT_RO             # optional — Snowflake role
+    settings: {}                   # optional — extra session parameters
+```
+> **Source-only**: a `snowflake` profile is valid **only** as a metric's or the
+> project's `source_profile` (hybrid mode) — `dtk run` refuses it as a state
+> profile (`--profile`/`default_profile`), so pair it with a full backend
+> (DuckDB/Postgres/ClickHouse) that holds the `_dtk_*` tables. See `metrics.md`
+> and the [Hybrid Mode guide](https://dtk.pipelab.dev/guides/hybrid-mode/).
+> Key-pair auth is first-class and recommended; a plain `password` works too.
+> The session `TIMEZONE` is pinned to UTC (override via `settings`). Billing
+> note: every query resumes the warehouse with a **60-second minimum bill**, so
+> hybrid mode (load from Snowflake, keep cheap local state) is the point.
+> `pip install 'detectkit[snowflake]'`.
+
+**BigQuery** (**source-only** — hybrid mode; runs a metric's load SQL, never
+holds `_dtk_*` state):
+```yaml
+profiles:
+  warehouse:
+    type: bigquery
+    project: my-analytics-project    # required — GCP project id billed for the queries
+    credentials_json_path: /etc/detectkit/bq-sa.json   # optional — service-account JSON key file
+    #                                # (unset -> Application Default Credentials)
+    location: EU                     # optional — job location (e.g. EU / US)
+    dataset: analytics               # optional — default dataset so unqualified table names resolve
+    api_endpoint: null               # optional — endpoint override; plain-http (the emulator) -> anonymous
+    #                                # auth when no key file; https endpoints authenticate normally
+    settings:                        # optional — extra QueryJobConfig attributes applied to every query
+      maximum_bytes_billed: 1000000000
+```
+> **Source-only**: a `bigquery` profile is valid **only** as a metric's or the
+> project's `source_profile` (hybrid mode) — `dtk run` refuses it as a state
+> profile (`--profile`/`default_profile`), so pair it with a full backend
+> (DuckDB/Postgres/ClickHouse) that holds the `_dtk_*` tables. See `metrics.md`
+> and the [Hybrid Mode guide](https://dtk.pipelab.dev/guides/hybrid-mode/).
+> Auth: `credentials_json_path` (a service-account key file) when set, else
+> **Application Default Credentials** (gcloud ADC / an attached service account
+> / Workload Identity); host/port/user/password are unused. Timestamps: a
+> BigQuery `TIMESTAMP` column comes back tz-aware UTC (handled by the loader),
+> `DATETIME` comes back naive — prefer `TIMESTAMP` (or a cast) for the metric's
+> timestamp column. Billing note: on-demand queries bill a **10 MiB minimum**
+> of bytes processed per query per referenced table, so frequent small
+> monitoring queries are disproportionately expensive — load from BigQuery,
+> keep cheap local state; `settings: {maximum_bytes_billed: ...}` caps what a
+> single query may scan. `pip install 'detectkit[bigquery]'`.
+
 ### Alert channels
 
 Defined once in `profiles.yml`, referenced by name in each metric's

{detectkit-0.63.0 → detectkit-0.65.0}/detectkit/cli/commands/run.py

@@ -341,6 +341,16 @@ def _run_impl(
         summary["error"] = f"Error: {source_profile_error}"
         return 1
 
+    # Fail-fast: the STATE profile must be a state-capable type. Like the
+    # source_profile check above this is a config error, not an outage —
+    # exit 1 without paging error_alerting (create_manager would raise the
+    # same refusal, but through the path that fires the error alert).
+    state_type_error = _validate_state_profile_type(profiles_config, profile)
+    if state_type_error:
+        click.echo(click.style(f"Error: {state_type_error}", fg="red", bold=True))
+        summary["error"] = f"Error: {state_type_error}"
+        return 1
+
     # Create database manager
     try:
         db_manager = profiles_config.create_manager(profile)
@@ -519,6 +529,33 @@ def _validate_source_profiles(
     )
 
 
+def _validate_state_profile_type(
+    profiles_config: ProfilesConfig, profile_name: str | None
+) -> str | None:
+    """Cheap, connection-free check that the STATE profile is state-capable.
+
+    A source-only profile type (e.g. ``snowflake``) pointed at by
+    ``--profile``/``default_profile`` is a config error, not an outage, so it
+    must exit 1 *without* paging ``error_alerting`` — same spirit as the
+    source_profile name check above. An unknown/unset profile name returns
+    ``None`` here so the existing ``create_manager`` path reports it exactly
+    as before. Duck-typed via ``getattr`` like ``_validate_source_profiles``,
+    so test doubles need not model the full ProfilesConfig surface.
+    """
+    known_profiles = getattr(profiles_config, "profiles", {}) or {}
+    name = profile_name or getattr(profiles_config, "default_profile", None)
+    profile_config = known_profiles.get(name) if name else None
+    if profile_config is None or not getattr(profile_config, "is_source_only", False):
+        return None
+    state_types = ", ".join(sorted(profile_config.STATE_TYPES))
+    return (
+        f"Profile type '{profile_config.type}' is source-only: it can serve "
+        f"as a metric/project 'source_profile' (hybrid mode), but it cannot "
+        f"hold detectkit state. Point --profile/default_profile at one of: "
+        f"{state_types}."
+    )
+
+
 def _resolve_report_path(report_path: str, project_root: Path, metric_name: str) -> Path:
     """Map the ``--report`` value to a concrete output file for a metric.
 

{detectkit-0.63.0 → detectkit-0.65.0}/detectkit/config/profile.py

@@ -5,13 +5,14 @@ Manages database connections and locations (similar to dbt profiles).
 """
 
 from pathlib import Path
-from typing import Any
+from typing import Any, ClassVar
 
 import yaml
-from pydantic import BaseModel, Field, field_validator, model_validator
+from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
 
 from detectkit.database.clickhouse_manager import ClickHouseDatabaseManager
 from detectkit.database.manager import BaseDatabaseManager
+from detectkit.database.source_manager import SourceDatabaseManager
 from detectkit.utils.env_interpolation import interpolate_env_vars
 
 
@@ -22,24 +23,74 @@ class ProfileConfig(BaseModel):
     Defines connection parameters and database locations for a specific
     environment (dev, prod, etc.).
 
+    Two classes of profile types exist:
+
+    - **Full backends** (``STATE_TYPES``: clickhouse/postgres/mysql/mariadb/
+      duckdb) can hold detectkit state (the ``_dtk_*`` tables) — and, since
+      state managers also expose ``execute_query``, double as hybrid-mode
+      sources.
+    - **Source-only backends** (``SOURCE_ONLY_TYPES``: snowflake, bigquery)
+      implement only connect + read query. They are valid **only** as a
+      metric/project ``source_profile``; :meth:`create_manager` refuses them
+      as a state profile with a clear error.
+
     Attributes:
-        type: Database type ("clickhouse", "postgres", "mysql", "mariadb", "duckdb")
+        type: Database type ("clickhouse", "postgres", "mysql", "mariadb",
+            "duckdb"; source-only: "snowflake", "bigquery")
         host: Database host (unused for DuckDB — it is an in-process, file-backed
-            database with no network endpoint)
-        port: Database port (unused for DuckDB; required for every other backend)
-        user: Database user (unused for DuckDB)
-        password: Database password (unused for DuckDB)
-        database: Connection-target database (PostgreSQL/MySQL/MariaDB; unused
-            for DuckDB — use `path` instead)
+            database with no network endpoint — and for Snowflake/BigQuery,
+            which connect by `account` / `project`)
+        port: Database port (unused for DuckDB/Snowflake/BigQuery; required
+            for every other backend)
+        user: Database user (unused for DuckDB/BigQuery; required explicitly
+            for Snowflake)
+        password: Database password (unused for DuckDB/BigQuery; for Snowflake
+            either `password` or `private_key_path` must be set)
+        database: Connection-target database (PostgreSQL/MySQL/MariaDB; the
+            session default database for Snowflake; unused for DuckDB — use
+            `path` instead)
         path: Path to the DuckDB database file, or ":memory:" for a transient
             in-process database (DuckDB only)
+        account: Snowflake account identifier (e.g. "myorg-myaccount")
+        warehouse: Snowflake virtual warehouse to run load queries on
+        role: Snowflake role for the session
+        schema_name: Session default schema (YAML key: `schema`; Snowflake only)
+        private_key_path: Path to a PEM private key for Snowflake key-pair
+            auth (recommended for service accounts)
+        private_key_passphrase: Passphrase of the private key, if encrypted
+        project: GCP project id billed for the queries (BigQuery only)
+        credentials_json_path: Path to a service-account JSON key file
+            (BigQuery only; unset -> Application Default Credentials)
+        location: Job location, e.g. "EU" (BigQuery only; unset -> inferred
+            from the referenced datasets)
+        dataset: Default dataset for unqualified table names in load queries
+            (BigQuery only)
+        api_endpoint: API endpoint override — the BigQuery emulator or a
+            private endpoint (BigQuery only)
         internal_database: Database/schema for internal tables
         internal_schema: Schema for internal tables (PostgreSQL/DuckDB only)
         data_database: Database for user data tables
         data_schema: Schema for user data (PostgreSQL/DuckDB only)
-        settings: Additional database-specific settings
+        settings: Additional database-specific settings (for Snowflake these
+            merge into the session parameters)
     """
 
+    # `schema_name` carries the YAML key `schema` via its alias (a field
+    # literally named `schema` would shadow pydantic's BaseModel attribute).
+    model_config = ConfigDict(populate_by_name=True)
+
+    # Full backends: may hold detectkit state (_dtk_* tables), and therefore
+    # also work as hybrid-mode sources.
+    STATE_TYPES: ClassVar[frozenset[str]] = frozenset(
+        {"clickhouse", "postgres", "mysql", "mariadb", "duckdb"}
+    )
+    # Source-only backends: connect + execute_query only (no DDL/upserts/
+    # locks); valid ONLY as a metric/project `source_profile` (hybrid mode).
+    SOURCE_ONLY_TYPES: ClassVar[frozenset[str]] = frozenset({"snowflake", "bigquery"})
+    # Backends with no network port to validate (in-process file DB;
+    # account/project-resolved cloud drivers).
+    _PORTLESS_TYPES: ClassVar[frozenset[str]] = frozenset({"duckdb", "snowflake", "bigquery"})
+
     type: str = Field(..., description="Database type")
     host: str = Field(default="localhost", description="Database host (unused for DuckDB)")
     # No default: required for every backend except DuckDB (enforced below by
@@ -70,6 +121,64 @@ class ProfileConfig(BaseModel):
         ),
     )
 
+    # Snowflake-only (source-only backend). host/port are meaningless for it:
+    # the driver resolves the endpoint from `account`.
+    account: str | None = Field(
+        default=None,
+        description="Snowflake account identifier, e.g. 'myorg-myaccount' (Snowflake only)",
+    )
+    warehouse: str | None = Field(
+        default=None,
+        description="Virtual warehouse to run load queries on (Snowflake only; "
+        "falls back to the user's default warehouse when unset)",
+    )
+    role: str | None = Field(
+        default=None,
+        description="Role for the session (Snowflake only; user's default role when unset)",
+    )
+    schema_name: str | None = Field(
+        default=None,
+        alias="schema",
+        description="Session default schema (Snowflake only; YAML key: 'schema')",
+    )
+    private_key_path: str | None = Field(
+        default=None,
+        description="Path to a PEM private key for key-pair auth (Snowflake only; "
+        "recommended for service accounts over 'password')",
+    )
+    private_key_passphrase: str | None = Field(
+        default=None,
+        description="Passphrase of the private key, when it is encrypted (Snowflake only)",
+    )
+
+    # BigQuery-only (source-only backend). host/port/user/password are
+    # meaningless for it: the client resolves the endpoint from `project` and
+    # authenticates via a service-account key file or ADC.
+    project: str | None = Field(
+        default=None,
+        description="GCP project id billed for the queries, e.g. 'my-project' (BigQuery only)",
+    )
+    credentials_json_path: str | None = Field(
+        default=None,
+        description="Path to a service-account JSON key file (BigQuery only; "
+        "unset -> Application Default Credentials)",
+    )
+    location: str | None = Field(
+        default=None,
+        description="Job location, e.g. 'EU' (BigQuery only; unset -> inferred "
+        "from the referenced datasets)",
+    )
+    dataset: str | None = Field(
+        default=None,
+        description="Default dataset for unqualified table names in load queries (BigQuery only)",
+    )
+    api_endpoint: str | None = Field(
+        default=None,
+        description="API endpoint override (BigQuery only) — a plain-http endpoint "
+        "(the BigQuery emulator) uses anonymous credentials when no key file is "
+        "set; https endpoints (regional/private) authenticate normally",
+    )
+
     # Internal location for _dtk_* tables
     internal_database: str | None = Field(
         default=None, description="Database for internal tables (ClickHouse/MySQL/MariaDB)"
@@ -90,14 +199,19 @@ class ProfileConfig(BaseModel):
         default_factory=dict, description="Additional database settings"
     )
 
+    @property
+    def is_source_only(self) -> bool:
+        """True for profile types valid only as a hybrid-mode ``source_profile``."""
+        return self.type in self.SOURCE_ONLY_TYPES
+
     @field_validator("type")
     @classmethod
     def validate_type(cls, v: str) -> str:
         """Validate database type."""
-        allowed_types = {"clickhouse", "postgres", "mysql", "mariadb", "duckdb"}
+        allowed_types = cls.STATE_TYPES | cls.SOURCE_ONLY_TYPES
         if v not in allowed_types:
             raise ValueError(
-                f"Invalid database type: {v}. " f"Allowed types: {', '.join(allowed_types)}"
+                f"Invalid database type: {v}. " f"Allowed types: {', '.join(sorted(allowed_types))}"
             )
         return v
 
@@ -113,11 +227,49 @@ class ProfileConfig(BaseModel):
 
     @model_validator(mode="after")
     def _validate_port_required(self) -> "ProfileConfig":
-        """Every backend but DuckDB needs a port; DuckDB has no network endpoint."""
-        if self.type != "duckdb" and self.port is None:
+        """Server backends need a port; DuckDB is in-process, Snowflake connects by account."""
+        if self.type not in self._PORTLESS_TYPES and self.port is None:
             raise ValueError(f"port is required for database type '{self.type}'")
         return self
 
+    @model_validator(mode="after")
+    def _validate_snowflake_fields(self) -> "ProfileConfig":
+        """Snowflake profiles need an account, an explicit user, and one auth method."""
+        if self.type != "snowflake":
+            return self
+        if not self.account:
+            raise ValueError(
+                "snowflake profiles must set 'account' "
+                "(the account identifier, e.g. 'myorg-myaccount')"
+            )
+        if "user" not in self.model_fields_set:
+            # `user` carries a generic default ("default") that would silently
+            # reach the Snowflake driver; require it spelled out.
+            raise ValueError("snowflake profiles must set 'user' explicitly")
+        if not self.password and not self.private_key_path:
+            raise ValueError(
+                "snowflake profiles must set 'password' or 'private_key_path' "
+                "(key-pair auth — recommended for service accounts)"
+            )
+        return self
+
+    @model_validator(mode="after")
+    def _validate_bigquery_fields(self) -> "ProfileConfig":
+        """BigQuery profiles need an explicit GCP project id.
+
+        Auth needs nothing further: `credentials_json_path` when set, else
+        Application Default Credentials (gcloud ADC / attached service
+        account / Workload Identity).
+        """
+        if self.type != "bigquery":
+            return self
+        if not self.project:
+            raise ValueError(
+                "bigquery profiles must set 'project' (the GCP project id billed "
+                "for the queries, e.g. 'my-project')"
+            )
+        return self
+
     def get_internal_location(self) -> str:
         """
         Get internal location (database or schema).
@@ -193,11 +345,19 @@ class ProfileConfig(BaseModel):
             Database manager instance
 
         Raises:
-            ValueError: If the database type is unsupported, or required
-                connection fields (e.g. PostgreSQL ``database``, DuckDB
-                ``path``) are missing
+            ValueError: If the database type is unsupported or source-only,
+                or required connection fields (e.g. PostgreSQL ``database``,
+                DuckDB ``path``) are missing
             ImportError: If the backend's driver is not installed
         """
+        if self.type in self.SOURCE_ONLY_TYPES:
+            raise ValueError(
+                f"Profile type '{self.type}' is source-only: it can serve as a "
+                f"metric/project 'source_profile' (hybrid mode — the metric's load "
+                f"SQL runs there while _dtk_* state stays in the state profile), "
+                f"but it cannot hold detectkit state. Point --profile/"
+                f"default_profile at one of: {', '.join(sorted(self.STATE_TYPES))}."
+            )
         if self.type == "clickhouse":
             # `port` is guaranteed non-None here by `_validate_port_required`
             # (every type but "duckdb" requires it at construction time).
@@ -273,6 +433,53 @@ class ProfileConfig(BaseModel):
         else:
             raise ValueError(f"Unsupported database type: {self.type}")
 
+    def create_source_manager(self) -> SourceDatabaseManager:
+        """
+        Create a manager for use as a hybrid-mode SOURCE (read-only load queries).
+
+        Source-only types build their lightweight query-only manager here;
+        full backends route through :meth:`create_manager` unchanged, so any
+        state-capable profile keeps working as a source exactly as before.
+
+        Returns:
+            A manager satisfying the minimal execute_query + close contract
+
+        Raises:
+            ValueError: If required connection fields are missing
+            ImportError: If the backend's driver is not installed
+        """
+        if self.type == "snowflake":
+            from detectkit.database.snowflake_manager import SnowflakeSourceManager
+
+            # Guaranteed by `_validate_snowflake_fields` at construction time.
+            assert self.account is not None
+            return SnowflakeSourceManager(
+                account=self.account,
+                user=self.user,
+                password=self.password or None,
+                private_key_path=self.private_key_path,
+                private_key_passphrase=self.private_key_passphrase,
+                warehouse=self.warehouse,
+                database=self.database,
+                schema=self.schema_name,
+                role=self.role,
+                settings=self.settings,
+            )
+        if self.type == "bigquery":
+            from detectkit.database.bigquery_manager import BigQuerySourceManager
+
+            # Guaranteed by `_validate_bigquery_fields` at construction time.
+            assert self.project is not None
+            return BigQuerySourceManager(
+                project=self.project,
+                credentials_json_path=self.credentials_json_path,
+                location=self.location,
+                dataset=self.dataset,
+                api_endpoint=self.api_endpoint,
+                settings=self.settings,
+            )
+        return self.create_manager()
+
 
 class ProfilesConfig(BaseModel):
     """
@@ -383,6 +590,23 @@ class ProfilesConfig(BaseModel):
         profile = self.get_profile(profile_name)
         return profile.create_manager(ensure_locations=ensure_locations)
 
+    def create_source_manager(self, profile_name: str | None = None) -> SourceDatabaseManager:
+        """
+        Create a manager for a profile used as a hybrid-mode SOURCE.
+
+        Unlike :meth:`create_manager`, source-only profile types (e.g.
+        Snowflake) are valid here; full backends behave exactly as with
+        :meth:`create_manager`.
+
+        Args:
+            profile_name: Profile name (if None, use default)
+
+        Returns:
+            A manager satisfying the minimal execute_query + close contract
+        """
+        profile = self.get_profile(profile_name)
+        return profile.create_source_manager()
+
     def get_alert_channel_config(self, channel_name: str) -> dict[str, Any]:
         """
         Get alert channel configuration by name.