elementary-runtime 0.1.0rc1__tar.gz

elementary_runtime-0.1.0rc1/.cursor/worktrees.json

@@ -0,0 +1,3 @@
+{
+  "setup-worktree-unix": "./script/setup.sh"
+}

elementary_runtime-0.1.0rc1/.github/workflows/dependency-review.yml

@@ -0,0 +1,31 @@
+name: Dependency Review
+
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      base-ref:
+        description: Base git ref for comparison (e.g. a tag or commit SHA)
+        required: true
+      head-ref:
+        description: Head git ref for comparison (defaults to HEAD)
+        required: false
+        default: HEAD
+
+permissions: {}
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          base-ref: ${{ inputs.base-ref || '' }}
+          head-ref: ${{ inputs.head-ref || '' }}

elementary_runtime-0.1.0rc1/.github/workflows/lint.yml

@@ -0,0 +1,53 @@
+name: Lint
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  hooks:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+
+      - name: Run hooks
+        env:
+          SKIP: mypy
+        run: uvx prek run --all-files --show-diff-on-failure
+
+  typecheck:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --frozen --group dev
+
+      - name: Run mypy
+        run: uv run --frozen mypy src tests

elementary_runtime-0.1.0rc1/.github/workflows/release.yml

@@ -0,0 +1,27 @@
+name: Release package
+
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  publish-to-pypi:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Build
+        run: uv build --out-dir dist
+
+      - name: Publish
+        run: uv publish dist/*

elementary_runtime-0.1.0rc1/.github/workflows/test.yml

@@ -0,0 +1,40 @@
+name: Test
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --frozen --python ${{ matrix.python-version }} --group dev
+
+      - name: Run tests
+        run: uv run --frozen pytest --cov

elementary_runtime-0.1.0rc1/.gitignore

@@ -0,0 +1,221 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer,
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml
+
+# macOS
+.DS_Store

elementary_runtime-0.1.0rc1/.pre-commit-config.yaml

@@ -0,0 +1,42 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+      - id: check-yaml
+      - id: check-toml
+      - id: check-merge-conflict
+      - id: check-added-large-files
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.16.6
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: https://github.com/astral-sh/uv-pre-commit
+    rev: 0.12.11
+    hooks:
+      - id: uv-lock
+
+  - repo: https://github.com/crate-ci/typos
+    rev: v1.50.1
+    hooks:
+      - id: typos
+
+  - repo: local
+    hooks:
+      - id: no_commit
+        name: Check for NO_COMMIT marker
+        entry: bash -c "git diff --cached -U0 -- . ':(exclude).pre-commit-config.yaml' | (! grep NO_COMMIT)"
+        language: system
+        require_serial: true
+        pass_filenames: false
+      - id: mypy
+        name: mypy
+        entry: uv run --frozen mypy src tests
+        language: system
+        pass_filenames: false
+        always_run: true

elementary_runtime-0.1.0rc1/.python-version

@@ -0,0 +1 @@
+3.12

elementary_runtime-0.1.0rc1/PKG-INFO

@@ -0,0 +1,95 @@
+Metadata-Version: 2.5
+Name: elementary-runtime
+Version: 0.1.0rc1
+Summary: Customer-side runtime that executes Elementary Cloud SQL against a warehouse.
+Project-URL: Homepage, https://www.elementary-data.com
+Project-URL: Repository, https://github.com/elementary-data/elementary-runtime
+Author-email: Elementary Data <team@elementary-data.com>
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: <3.15,>=3.10
+Requires-Dist: expandvars<2,>=1.1.2
+Requires-Dist: pydantic<3,>=2.11
+Requires-Dist: pyyaml<7,>=6
+Description-Content-Type: text/markdown
+
+# Elementary Runtime
+
+> Early development. This package is a skeleton and is not usable yet.
+
+Elementary Runtime is a small service that customers run in their own
+environment. It uses local warehouse credentials to execute SQL prepared by
+Elementary Cloud, so Cloud never holds credentials that can read customer
+business tables.
+
+Warehouse drivers will be optional extras. Installing the base package for
+task models will not pull in every warehouse driver or the full runtime.
+
+A license has not been chosen yet.
+
+## Security-critical code
+
+Local safety controls live under
+[`src/elementary_runtime/execution/`](src/elementary_runtime/execution/).
+That tree is the audited surface: SQL validation, query execution with limits
+applied while rows are fetched and encoded, and redaction of SQL, row values,
+credentials, and unrestricted warehouse errors from logs and telemetry.
+
+## Repository layout
+
+```text
+src/elementary_runtime/
+  protocol/      Task and result wire formats
+  config/        Versioned YAML configuration and local limits
+  common/        Shared helpers used by protocol and config
+  warehouses/    Warehouse clients (drivers behind extras)
+  execution/     Audited local safety controls
+    sql/         SQL validation
+    worker/      Worker pool, query execution, limit enforcement
+    redaction/   Error, log, and telemetry scrubbing
+  coordinator/   Register, poll, heartbeat, submit, retries, shutdown
+```
+
+## Configuration
+
+```yaml
+version: 1
+cloud:
+  token_file: /run/secrets/elementary_runtime_token
+connections:
+  - warehouse_connection_id: connection-id
+    type: snowflake
+    account: ab12345.eu-central-1
+    user: elementary_runtime
+    password_file: /run/secrets/snowflake_password
+```
+
+## Development
+
+Requires [uv](https://docs.astral.sh/uv/) and Python 3.10–3.14. Local
+development uses Python 3.12.
+
+After a clone or a new Git worktree, install the environment and hooks:
+
+```bash
+./script/setup.sh
+```
+
+Then:
+
+```bash
+uv run pytest
+uv run mypy src tests
+uvx prek run --all-files
+```
+
+The package version lives in `pyproject.toml`. Bump it with
+`uv version --bump patch` (or `minor` / `major`). At runtime,
+`elementary_runtime.__version__` is read from the installed distribution
+metadata.

elementary_runtime-0.1.0rc1/README.md

@@ -0,0 +1,74 @@
+# Elementary Runtime
+
+> Early development. This package is a skeleton and is not usable yet.
+
+Elementary Runtime is a small service that customers run in their own
+environment. It uses local warehouse credentials to execute SQL prepared by
+Elementary Cloud, so Cloud never holds credentials that can read customer
+business tables.
+
+Warehouse drivers will be optional extras. Installing the base package for
+task models will not pull in every warehouse driver or the full runtime.
+
+A license has not been chosen yet.
+
+## Security-critical code
+
+Local safety controls live under
+[`src/elementary_runtime/execution/`](src/elementary_runtime/execution/).
+That tree is the audited surface: SQL validation, query execution with limits
+applied while rows are fetched and encoded, and redaction of SQL, row values,
+credentials, and unrestricted warehouse errors from logs and telemetry.
+
+## Repository layout
+
+```text
+src/elementary_runtime/
+  protocol/      Task and result wire formats
+  config/        Versioned YAML configuration and local limits
+  common/        Shared helpers used by protocol and config
+  warehouses/    Warehouse clients (drivers behind extras)
+  execution/     Audited local safety controls
+    sql/         SQL validation
+    worker/      Worker pool, query execution, limit enforcement
+    redaction/   Error, log, and telemetry scrubbing
+  coordinator/   Register, poll, heartbeat, submit, retries, shutdown
+```
+
+## Configuration
+
+```yaml
+version: 1
+cloud:
+  token_file: /run/secrets/elementary_runtime_token
+connections:
+  - warehouse_connection_id: connection-id
+    type: snowflake
+    account: ab12345.eu-central-1
+    user: elementary_runtime
+    password_file: /run/secrets/snowflake_password
+```
+
+## Development
+
+Requires [uv](https://docs.astral.sh/uv/) and Python 3.10–3.14. Local
+development uses Python 3.12.
+
+After a clone or a new Git worktree, install the environment and hooks:
+
+```bash
+./script/setup.sh
+```
+
+Then:
+
+```bash
+uv run pytest
+uv run mypy src tests
+uvx prek run --all-files
+```
+
+The package version lives in `pyproject.toml`. Bump it with
+`uv version --bump patch` (or `minor` / `major`). At runtime,
+`elementary_runtime.__version__` is read from the installed distribution
+metadata.

elementary_runtime-0.1.0rc1/pyproject.toml

@@ -0,0 +1,72 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "elementary-runtime"
+version = "0.1.0rc1"
+description = "Customer-side runtime that executes Elementary Cloud SQL against a warehouse."
+readme = "README.md"
+authors = [
+    { name = "Elementary Data", email = "team@elementary-data.com" },
+]
+requires-python = ">=3.10,<3.15"
+classifiers = [
+    "Development Status :: 2 - Pre-Alpha",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+]
+dependencies = [
+    "pydantic>=2.11,<3",
+    "pyyaml>=6,<7",
+    "expandvars>=1.1.2,<2",
+]
+
+[project.urls]
+Homepage = "https://www.elementary-data.com"
+Repository = "https://github.com/elementary-data/elementary-runtime"
+
+[dependency-groups]
+dev = [
+    "pytest>=9.1.1",
+    "pytest-cov>=7.1.0",
+    "mypy>=1.18.2",
+    "ruff>=0.16.6",
+    "prek>=0.5.2",
+    "types-PyYAML>=6.0.12,<7",
+]
+
+[tool.ruff]
+target-version = "py310"
+src = ["src"]
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B", "SIM", "RUF"]
+
+[tool.mypy]
+strict = true
+python_version = "3.10"
+files = ["src", "tests"]
+plugins = ["pydantic.mypy"]
+
+[[tool.mypy.overrides]]
+module = "expandvars"
+ignore_missing_imports = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-ra --strict-markers --strict-config --import-mode=importlib"
+xfail_strict = true
+
+[tool.coverage.run]
+source = ["src"]
+branch = true
+
+[tool.coverage.report]
+show_missing = true
+skip_covered = true

elementary_runtime-0.1.0rc1/script/setup.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(cd "$(dirname "$0")/.." && pwd)"
+
+if ! command -v uv >/dev/null 2>&1; then
+  echo "uv not found; installing from https://astral.sh/uv/"
+  curl -LsSf https://astral.sh/uv/install.sh | sh
+  export PATH="${HOME}/.local/bin:${PATH}"
+fi
+
+uv sync --frozen --group dev
+uvx prek install
+
+echo "Setup complete."

elementary_runtime-0.1.0rc1/src/elementary_runtime/__init__.py

@@ -0,0 +1,5 @@
+from importlib.metadata import version
+
+__version__ = version("elementary-runtime")
+
+__all__ = ["__version__"]