dlt-firebolt 0.1.0__tar.gz

dlt_firebolt-0.1.0/.dlt/config.toml

@@ -0,0 +1,3 @@
+# Non-sensitive dlt defaults for this destination prototype.
+[pipeline]
+loader_file_format = "parquet"

dlt_firebolt-0.1.0/.dlt/secrets.toml.example

@@ -0,0 +1,20 @@
+# Copy to .dlt/secrets.toml (gitignored). Do not commit real credentials.
+
+[destination.firebolt]
+# Option A: connection string (recommended)
+# credentials = "firebolt://CLIENT_ID:CLIENT_SECRET@DATABASE/ENGINE?account_name=ACCOUNT"
+
+s3_location_name = "your_location_name"
+s3_prefix = "dlt-landing"
+
+# Option B: structured credentials
+# Firebolt maps to SQLAlchemy URL as host=DATABASE, database=ENGINE (see firebolt_url_from_env).
+[destination.firebolt.credentials]
+host = "YOUR_DATABASE"
+database = "YOUR_ENGINE"
+username = "YOUR_CLIENT_ID"
+password = "YOUR_CLIENT_SECRET"
+account_name = "YOUR_ACCOUNT_NAME"
+
+[destination.filesystem]
+bucket_url = "s3://YOUR_BUCKET/dlt-landing/dlt/staging"

dlt_firebolt-0.1.0/.env.example

@@ -0,0 +1,17 @@
+# Firebolt service account (Settings → Service accounts)
+FIREBOLT_CLIENT_ID=
+FIREBOLT_CLIENT_SECRET=
+FIREBOLT_ACCOUNT_NAME=
+FIREBOLT_DATABASE=
+FIREBOLT_ENGINE=
+
+# S3 staging — must match the name from your Firebolt CREATE LOCATION statement
+# (e.g. CREATE LOCATION "sprinto_s3" WITH SOURCE='CLOUD_STORAGE' URL='s3://...')
+FIREBOLT_S3_LOCATION_NAME=sprinto_s3
+S3_BUCKET=
+S3_PREFIX=dlt-landing
+
+# Optional: HubSpot demo scripts only (phase1 / phase3)
+HUBSPOT_ACCESS_TOKEN=
+
+# AWS credentials for S3 staging (e.g. export AWS_PROFILE=your-profile)

dlt_firebolt-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install package and test deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Unit tests
+        run: pytest -q -m "not integration"

dlt_firebolt-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,39 @@
+name: Publish to PyPI
+
+# Mirrors firebolt-db Python SDK auth: TWINE_* from PYPI_USERNAME / PYPI_PASSWORD.
+# Prerequisite: add those secrets to firebolt-analytics/dlt-firebolt (org secrets
+# do not cross from firebolt-db). Bump version in pyproject.toml before release.
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build tooling
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]" build twine
+
+      - name: Unit tests
+        run: pytest -q -m "not integration"
+
+      - name: Build
+        run: python -m build
+
+      - name: Publish
+        env:
+          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
+          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
+        run: twine upload dist/*

dlt_firebolt-0.1.0/.gitignore

@@ -0,0 +1,12 @@
+.venv/
+.env
+.dlt/secrets.toml
+.dlt/pipelines/
+__pycache__/
+*.py[cod]
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+build/
+dist/
+.DS_Store

dlt_firebolt-0.1.0/LICENSE

@@ -0,0 +1,18 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   Copyright 2026 Firebolt Analytics Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

dlt_firebolt-0.1.0/PKG-INFO

@@ -0,0 +1,194 @@
+Metadata-Version: 2.4
+Name: dlt-firebolt
+Version: 0.1.0
+Summary: dlt destination for Firebolt (staged Parquet + COPY INTO)
+Project-URL: Homepage, https://github.com/firebolt-analytics/dlt-firebolt
+Project-URL: Repository, https://github.com/firebolt-analytics/dlt-firebolt
+Author: Firebolt Analytics
+License: Apache-2.0
+License-File: LICENSE
+Keywords: data-pipeline,dlt,etl,firebolt
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Database
+Requires-Python: >=3.10
+Requires-Dist: dlt[parquet,s3,sqlalchemy]>=1.0.0
+Requires-Dist: firebolt-sqlalchemy
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: python-dotenv; extra == 'dev'
+Requires-Dist: requests; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# dlt-firebolt
+
+Prototype [dlt](https://dlthub.com/) destination for [Firebolt](https://www.firebolt.io/).
+
+Loads dlt pipelines into Firebolt using **filesystem staging (Parquet on S3) + `COPY INTO`**, the same pattern as dlt's Snowflake and Redshift destinations.
+
+## Status
+
+Spike complete. Hardening done; packaging and upstream prep in progress.
+
+| Phase | What it proved |
+|-------|----------------|
+| 1 | dlt → S3 Parquet → manual COPY INTO |
+| 2 | Generic `sqlalchemy` destination is not viable on Firebolt |
+| 3 | Native `destination="firebolt"` end-to-end |
+| 4 | Append / merge / replace disposition scripts |
+
+See [SPIKE.md](SPIKE.md) for spike notes.
+
+## License
+
+Apache License 2.0 — see [LICENSE](LICENSE).
+
+## Install
+
+```bash
+python -m venv .venv
+source .venv/bin/activate
+pip install -e ".[dev]"
+cp .env.example .env   # fill in Firebolt + S3 creds
+```
+
+Or install dependencies only (no editable package):
+
+```bash
+pip install -r requirements.txt
+pip install -r requirements-dev.txt
+```
+
+## Quick start (Phase 3 demo)
+
+Requires:
+
+- Firebolt `CREATE LOCATION` for your S3 bucket — set `FIREBOLT_S3_LOCATION_NAME` to the location name (e.g. `sprinto_s3`)
+- HubSpot private app token in `.env` (demo only)
+- AWS credentials for S3 staging
+
+```bash
+export AWS_PROFILE=your-profile
+python phase3_hubspot_to_firebolt.py
+```
+
+Optional: copy `.dlt/secrets.toml.example` to `.dlt/secrets.toml` and run with `DLT_USE_SECRETS=1`.
+
+Before running demos, validate credentials:
+
+```bash
+python check_firebolt_env.py
+```
+
+### Disposition checks (Phase 4)
+
+Run each command separately (do not paste inline comments):
+
+```bash
+python phase4_dispositions.py --mode merge
+python phase4_dispositions.py --mode append
+python phase4_dispositions.py --mode append
+python phase4_dispositions.py --mode replace
+```
+
+For append, run the command twice and confirm the row count grows.
+
+Verify in Firebolt (default dataset `demo`):
+
+```sql
+SELECT COUNT(*) FROM demo_hubspot_contacts;
+```
+
+## Usage in a dlt pipeline
+
+```python
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import dlt
+from firebolt_dest.configuration import make_firebolt_pipeline
+
+pipeline = make_firebolt_pipeline(
+    pipeline_name="my_pipeline",
+    dataset_name="my_dataset",
+)
+
+pipeline.run(my_resource(), loader_file_format="parquet")
+```
+
+Or with `.dlt/secrets.toml`:
+
+```python
+pipeline = make_firebolt_pipeline(
+    pipeline_name="my_pipeline",
+    dataset_name="my_dataset",
+    from_secrets=True,
+)
+```
+
+Tables land as `{dataset}_{table}` (e.g. `my_dataset_orders`).
+
+Connection details from environment variables — see [.env.example](.env.example) — or from `.dlt/secrets.toml` — see [.dlt/secrets.toml.example](.dlt/secrets.toml.example).
+
+## Layout
+
+```
+firebolt_dest/          # destination implementation (fork Redshift COPY pattern)
+  factory.py            # registers destination="firebolt"
+  client.py             # COPY load jobs
+  sql_client.py         # Firebolt SQLAlchemy client
+  copy_sql.py           # COPY INTO SQL generation
+  configuration.py      # credentials + S3 location config
+phase1_*.py             # spike: dlt → S3 only
+phase2_*.py             # spike: dialect smoke test
+phase3_*.py             # spike: full native destination demo
+phase4_*.py             # append / merge / replace disposition checks
+.dlt/config.toml        # non-sensitive dlt defaults (parquet loader)
+.dlt/secrets.toml.example
+tests/                  # unit tests (no Firebolt connection)
+```
+
+## Configuration
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `FIREBOLT_CLIENT_ID` | yes | Service account client ID |
+| `FIREBOLT_CLIENT_SECRET` | yes | Service account secret |
+| `FIREBOLT_ACCOUNT_NAME` | yes | Firebolt account name |
+| `FIREBOLT_DATABASE` | yes | Target database |
+| `FIREBOLT_ENGINE` | yes | Engine name |
+| `FIREBOLT_S3_LOCATION_NAME` | yes* | Firebolt external location name (must match `CREATE LOCATION`; e.g. `sprinto_s3`) |
+| `S3_BUCKET` | yes | Staging bucket |
+| `S3_PREFIX` | no | Key prefix (default: `dlt-landing`) |
+| `DLT_DATASET_NAME` | no | Demo dataset (default: `demo`) |
+
+Credentials belong in `.env` (gitignored) or `.dlt/secrets.toml` (gitignored). See `.dlt/secrets.toml.example`.
+
+## Tests
+
+```bash
+pip install -r requirements-dev.txt
+pytest
+
+# Optional: live Firebolt + S3 (requires .env and AWS creds)
+FIREBOLT_RUN_INTEGRATION=1 pytest -m integration -v
+```
+
+## Roadmap
+
+- [x] Package as installable module (`pip install -e .` / `dlt-firebolt`)
+- [x] Config via env vars and `.dlt/secrets.toml` (both live-tested)
+- [x] Merge/append/replace dispositions (merge via delete-insert; replace via truncate-and-insert or insert-from-staging)
+- [x] Unit tests for COPY and merge SQL generation
+- [x] Integration test harness (env-gated)
+- [x] Destination README (dlt-style setup doc)
+- [ ] PyPI publish (`pip install dlt-firebolt` from PyPI)
+- [ ] Upstream PR to [dlt](https://github.com/dlt-hub/dlt) or community listing
+
+## Related
+
+Customer connector demos that consume this pattern live separately in [sprinto-connectors](https://github.com/firebolt-analytics/sprinto-connectors) (private).

dlt_firebolt-0.1.0/README.md

@@ -0,0 +1,170 @@
+# dlt-firebolt
+
+Prototype [dlt](https://dlthub.com/) destination for [Firebolt](https://www.firebolt.io/).
+
+Loads dlt pipelines into Firebolt using **filesystem staging (Parquet on S3) + `COPY INTO`**, the same pattern as dlt's Snowflake and Redshift destinations.
+
+## Status
+
+Spike complete. Hardening done; packaging and upstream prep in progress.
+
+| Phase | What it proved |
+|-------|----------------|
+| 1 | dlt → S3 Parquet → manual COPY INTO |
+| 2 | Generic `sqlalchemy` destination is not viable on Firebolt |
+| 3 | Native `destination="firebolt"` end-to-end |
+| 4 | Append / merge / replace disposition scripts |
+
+See [SPIKE.md](SPIKE.md) for spike notes.
+
+## License
+
+Apache License 2.0 — see [LICENSE](LICENSE).
+
+## Install
+
+```bash
+python -m venv .venv
+source .venv/bin/activate
+pip install -e ".[dev]"
+cp .env.example .env   # fill in Firebolt + S3 creds
+```
+
+Or install dependencies only (no editable package):
+
+```bash
+pip install -r requirements.txt
+pip install -r requirements-dev.txt
+```
+
+## Quick start (Phase 3 demo)
+
+Requires:
+
+- Firebolt `CREATE LOCATION` for your S3 bucket — set `FIREBOLT_S3_LOCATION_NAME` to the location name (e.g. `sprinto_s3`)
+- HubSpot private app token in `.env` (demo only)
+- AWS credentials for S3 staging
+
+```bash
+export AWS_PROFILE=your-profile
+python phase3_hubspot_to_firebolt.py
+```
+
+Optional: copy `.dlt/secrets.toml.example` to `.dlt/secrets.toml` and run with `DLT_USE_SECRETS=1`.
+
+Before running demos, validate credentials:
+
+```bash
+python check_firebolt_env.py
+```
+
+### Disposition checks (Phase 4)
+
+Run each command separately (do not paste inline comments):
+
+```bash
+python phase4_dispositions.py --mode merge
+python phase4_dispositions.py --mode append
+python phase4_dispositions.py --mode append
+python phase4_dispositions.py --mode replace
+```
+
+For append, run the command twice and confirm the row count grows.
+
+Verify in Firebolt (default dataset `demo`):
+
+```sql
+SELECT COUNT(*) FROM demo_hubspot_contacts;
+```
+
+## Usage in a dlt pipeline
+
+```python
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import dlt
+from firebolt_dest.configuration import make_firebolt_pipeline
+
+pipeline = make_firebolt_pipeline(
+    pipeline_name="my_pipeline",
+    dataset_name="my_dataset",
+)
+
+pipeline.run(my_resource(), loader_file_format="parquet")
+```
+
+Or with `.dlt/secrets.toml`:
+
+```python
+pipeline = make_firebolt_pipeline(
+    pipeline_name="my_pipeline",
+    dataset_name="my_dataset",
+    from_secrets=True,
+)
+```
+
+Tables land as `{dataset}_{table}` (e.g. `my_dataset_orders`).
+
+Connection details from environment variables — see [.env.example](.env.example) — or from `.dlt/secrets.toml` — see [.dlt/secrets.toml.example](.dlt/secrets.toml.example).
+
+## Layout
+
+```
+firebolt_dest/          # destination implementation (fork Redshift COPY pattern)
+  factory.py            # registers destination="firebolt"
+  client.py             # COPY load jobs
+  sql_client.py         # Firebolt SQLAlchemy client
+  copy_sql.py           # COPY INTO SQL generation
+  configuration.py      # credentials + S3 location config
+phase1_*.py             # spike: dlt → S3 only
+phase2_*.py             # spike: dialect smoke test
+phase3_*.py             # spike: full native destination demo
+phase4_*.py             # append / merge / replace disposition checks
+.dlt/config.toml        # non-sensitive dlt defaults (parquet loader)
+.dlt/secrets.toml.example
+tests/                  # unit tests (no Firebolt connection)
+```
+
+## Configuration
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `FIREBOLT_CLIENT_ID` | yes | Service account client ID |
+| `FIREBOLT_CLIENT_SECRET` | yes | Service account secret |
+| `FIREBOLT_ACCOUNT_NAME` | yes | Firebolt account name |
+| `FIREBOLT_DATABASE` | yes | Target database |
+| `FIREBOLT_ENGINE` | yes | Engine name |
+| `FIREBOLT_S3_LOCATION_NAME` | yes* | Firebolt external location name (must match `CREATE LOCATION`; e.g. `sprinto_s3`) |
+| `S3_BUCKET` | yes | Staging bucket |
+| `S3_PREFIX` | no | Key prefix (default: `dlt-landing`) |
+| `DLT_DATASET_NAME` | no | Demo dataset (default: `demo`) |
+
+Credentials belong in `.env` (gitignored) or `.dlt/secrets.toml` (gitignored). See `.dlt/secrets.toml.example`.
+
+## Tests
+
+```bash
+pip install -r requirements-dev.txt
+pytest
+
+# Optional: live Firebolt + S3 (requires .env and AWS creds)
+FIREBOLT_RUN_INTEGRATION=1 pytest -m integration -v
+```
+
+## Roadmap
+
+- [x] Package as installable module (`pip install -e .` / `dlt-firebolt`)
+- [x] Config via env vars and `.dlt/secrets.toml` (both live-tested)
+- [x] Merge/append/replace dispositions (merge via delete-insert; replace via truncate-and-insert or insert-from-staging)
+- [x] Unit tests for COPY and merge SQL generation
+- [x] Integration test harness (env-gated)
+- [x] Destination README (dlt-style setup doc)
+- [ ] PyPI publish (`pip install dlt-firebolt` from PyPI)
+- [ ] Upstream PR to [dlt](https://github.com/dlt-hub/dlt) or community listing
+
+## Related
+
+Customer connector demos that consume this pattern live separately in [sprinto-connectors](https://github.com/firebolt-analytics/sprinto-connectors) (private).

dlt_firebolt-0.1.0/SPIKE.md

@@ -0,0 +1,55 @@
+# dlt × Firebolt spike
+
+Benjamin asked: how hard is a native Firebolt destination?
+
+**Goal:** prove dlt replaces connector boilerplate, then scope a upstreamable `destination="firebolt"`.
+
+## Phase 1 — dlt → S3
+
+Prove dlt handles schema, state, incrementals. You run COPY INTO separately.
+
+```bash
+cd ~/dlt-firebolt-spike
+python -m venv .venv && source .venv/bin/activate
+pip install -r requirements.txt
+cp .env.example .env   # fill in creds
+export AWS_PROFILE=your-profile
+python phase1_hubspot_to_s3.py
+```
+
+**Success:** Parquet lands in S3; row counts match source after COPY.
+
+## Phase 2 — Dialect smoke test
+
+```bash
+python phase2_dialect_smoke.py
+```
+
+**Expected:** literal + parametrized INSERT pass; dlt sqlalchemy load fails on schema sync.
+**Implication:** build native destination with CREATE TABLE + staged COPY (Phase 3).
+
+## Phase 3 — Native destination prototype
+
+```bash
+export AWS_PROFILE=your-profile
+python phase3_hubspot_to_firebolt.py
+```
+
+Verify: `SELECT COUNT(*) FROM demo_hubspot_contacts;` (or your `DLT_DATASET_NAME`).
+
+**Module:** `firebolt_dest/` — pip package `dlt-firebolt`; see `firebolt_dest/README.md`.
+
+## Upstream checklist (Benjamin)
+
+| Item | Status |
+|------|--------|
+| E2E prototype (`destination="firebolt"`) | Done |
+| Merge / append / replace dispositions | Done (live validated) |
+| Config (env vars + secrets.toml) | Done (env live-tested; secrets.toml live-tested after host/database fix) |
+| dlt internal tables (loads, state, version) | Done (state sync works) |
+| Unit tests | Done |
+| pip installable package | Done |
+| Integration test harness | Done (opt-in via env) |
+| Destination setup docs | Done |
+| PyPI publish | Pending |
+| PR to dlt-hub/dlt | Pending (dlt policy: new destinations rarely merged; community package path) |

dlt_firebolt-0.1.0/check_firebolt_env.py

@@ -0,0 +1,123 @@
+#!/usr/bin/env python3
+"""Validate Firebolt + S3 env before running phase3/phase4."""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+import sqlalchemy as sa
+from dotenv import load_dotenv
+
+ROOT = Path(__file__).resolve().parent
+sys.path.insert(0, str(ROOT))
+
+from firebolt_dest.configuration import (
+    firebolt_url_from_env,
+    s3_location_name_from_env,
+    staging_bucket_url,
+)
+
+load_dotenv(ROOT / ".env")
+
+REQUIRED = (
+    "FIREBOLT_CLIENT_ID",
+    "FIREBOLT_CLIENT_SECRET",
+    "FIREBOLT_ACCOUNT_NAME",
+    "FIREBOLT_DATABASE",
+    "FIREBOLT_ENGINE",
+    "S3_BUCKET",
+)
+
+
+def _mask(value: str) -> str:
+    value = value.strip()
+    if len(value) <= 4:
+        return "****"
+    return f"{value[:2]}...{value[-2:]}"
+
+
+def main() -> int:
+    print("Firebolt / S3 environment check\n")
+
+    missing = [name for name in REQUIRED if not os.environ.get(name, "").strip()]
+    if missing:
+        print("Missing required variables:")
+        for name in missing:
+            print(f"  - {name}")
+        return 1
+
+    for name in REQUIRED:
+        print(f"  {name} = {_mask(os.environ[name])}")
+
+    print(f"  FIREBOLT_S3_LOCATION_NAME = {s3_location_name_from_env()}")
+    print(f"  S3_PREFIX = {os.environ.get('S3_PREFIX', 'dlt-landing')}")
+    print(f"  staging bucket_url = {staging_bucket_url()}")
+    print()
+
+    url = firebolt_url_from_env()
+    print("Testing Firebolt OAuth + SQL connection...")
+    try:
+        engine = sa.create_engine(url)
+        with engine.connect() as conn:
+            conn.execute(sa.text("SELECT 1"))
+        print("  OK: Firebolt credentials accepted.")
+    except Exception as exc:
+        print("  FAIL: Firebolt authentication or connection failed.")
+        print(f"  {type(exc).__name__}: {exc}")
+        print()
+        print("Fix:")
+        print("  1. Firebolt console → Settings → Service accounts")
+        print("  2. Create a new service account or rotate the secret")
+        print("  3. Update FIREBOLT_CLIENT_ID and FIREBOLT_CLIENT_SECRET in .env")
+        print("  4. Confirm FIREBOLT_ACCOUNT_NAME, FIREBOLT_DATABASE, FIREBOLT_ENGINE")
+        return 2
+
+    location_name = s3_location_name_from_env()
+    print(f"Testing Firebolt external location '{location_name}'...")
+    try:
+        engine = sa.create_engine(url)
+        with engine.connect() as conn:
+            rows = conn.execute(
+                sa.text(
+                    "SELECT 1 FROM information_schema.locations "
+                    "WHERE location_name = :name"
+                ),
+                {"name": location_name},
+            ).fetchall()
+        if not rows:
+            print(f"  FAIL: Location '{location_name}' not found in this database.")
+            print()
+            print("Fix:")
+            print("  1. Run CREATE LOCATION in Firebolt for your S3 bucket")
+            print("  2. Set FIREBOLT_S3_LOCATION_NAME to that exact location name")
+            return 4
+        print(f"  OK: Location '{location_name}' exists.")
+    except Exception as exc:
+        print(f"  WARN: Could not verify location ({type(exc).__name__}: {exc})")
+
+    print()
+    print("Testing S3 staging access...")
+    try:
+        import fsspec
+
+        fs, _ = fsspec.core.url_to_fs(staging_bucket_url())
+        fs.ls(fs._strip_protocol(staging_bucket_url()), detail=False)
+        print("  OK: S3 staging bucket reachable.")
+    except Exception as exc:
+        print("  FAIL: S3 staging not reachable with current AWS credentials.")
+        print(f"  {type(exc).__name__}: {exc}")
+        print()
+        print("Fix:")
+        print("  export AWS_PROFILE=sandbox")
+        print("  aws sso login --profile sandbox")
+        return 3
+
+    print()
+    print("All checks passed. You can run phase3/phase4.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())