streamsnow 0.1.0__py3-none-any.whl

streamsnow/__init__.py

@@ -0,0 +1,19 @@
+"""StreamSnow — open-source toolkit for Streamlit-in-Snowflake apps with Claude Code.
+
+The ``streamsnow`` package is the single source of truth for tool logic. The CLI,
+the Claude Code plugin, pre-commit, and CI all call into this package — one
+implementation, many consumers.
+"""
+
+from __future__ import annotations
+
+__all__ = ["__version__"]
+
+# Keep in sync with [project.version] in pyproject.toml. Read dynamically when
+# installed so `streamsnow --version` reflects the resolved distribution.
+try:  # pragma: no cover - trivial
+    from importlib.metadata import version as _version
+
+    __version__ = _version("streamsnow")
+except Exception:  # pragma: no cover - source checkout without install
+    __version__ = "0.1.0"

streamsnow/_templates/app/AGENTS.md.j2

@@ -0,0 +1,15 @@
+# {{ app_title }}
+
+App-specific context. Inherits the repo rulebook in the top-level `AGENTS.md`.
+
+- **Runtime:** {{ runtime }} · **Query warehouse:** `{{ default_warehouse }}`
+- **Data sources:** `{{ gov_database }}` (schemas: {{ schema_allow | join(', ') }})
+- **Caching strategy:** default TTL {{ cache_ttl }}s. Note any per-query deviations here with a reason.
+
+## Pages
+
+- **Overview** (`pages/overview.py`) — starter page; replace the example metric with your real KPIs.
+
+## Queries
+
+- `queries/example_metric.sql` — placeholder; repoint `YOUR_TABLE` at a real object in an allowed schema.

streamsnow/_templates/app/branding.py.j2

@@ -0,0 +1,51 @@
+"""Branding for {{ project_name }} — generated by StreamSnow from brand config.
+
+Each app ships its own local copy (deploy runtimes can't import a shared module).
+Import locally: ``from branding import apply_branding, branded_metric``.
+"""
+
+import plotly.graph_objects as go
+import plotly.io as pio
+import streamlit as st
+
+_BRANDING_VERSION = "1.0.0"
+
+BRAND_COLORS = {
+    "primary": "{{ brand.primary }}",
+    "background": "{{ brand.background }}",
+    "text": "{{ brand.text_color }}",
+}
+BRAND_CHART_COLORS = [{{ brand.chart_sequence | map('tojson') | join(", ") }}]
+
+# Register the Plotly template once. Guard against re-registration AND the
+# default-set side effect: the container runtime shares one Python process
+# across all viewers, so module-import mutations must be idempotent.
+if "streamsnow_brand" not in pio.templates:
+    pio.templates["streamsnow_brand"] = go.layout.Template(
+        layout=dict(
+            font=dict(family="{{ brand.font }}", color="{{ brand.text_color }}"),
+            colorway=BRAND_CHART_COLORS,
+            paper_bgcolor="{{ brand.background }}",
+            plot_bgcolor="{{ brand.background }}",
+        )
+    )
+    pio.templates.default = "streamsnow_brand"
+BRAND_PLOTLY_TEMPLATE = "streamsnow_brand"
+
+
+def apply_branding() -> None:
+    """Call once, right after ``st.set_page_config``. Sets the Plotly default."""
+    pio.templates.default = "streamsnow_brand"
+
+
+def branded_metric(label: str, value: str, delta: str | None = None, border_color: str | None = None) -> None:
+    """A metric card with a brand-colored left border."""
+    color = border_color or BRAND_COLORS["primary"]
+    delta_html = f'<div style="font-size:0.8rem;color:#6b7280;">{delta}</div>' if delta else ""
+    st.markdown(
+        f'<div style="border-left:4px solid {color};padding:0.25rem 0.75rem;margin:0.25rem 0;">'
+        f'<div style="font-size:0.8rem;color:#6b7280;">{label}</div>'
+        f'<div style="font-size:1.6rem;font-weight:600;">{value}</div>'
+        f"{delta_html}</div>",
+        unsafe_allow_html=True,
+    )

streamsnow/_templates/app/config.toml.j2

@@ -0,0 +1,8 @@
+[theme]
+base = "light"
+primaryColor = "{{ brand.primary }}"
+backgroundColor = "{{ brand.background }}"
+secondaryBackgroundColor = "{{ brand.secondary_background }}"
+textColor = "{{ brand.text_color }}"
+font = "sans serif"
+chartCategoricalColors = [{{ brand.chart_sequence | map('tojson') | join(", ") }}]

streamsnow/_templates/app/environment.yml.j2

@@ -0,0 +1,11 @@
+# Warehouse-runtime dependencies (Snowflake Anaconda channel).
+# LANDMINE: never pin `python` here — the channel has no exact python==3.11
+# build, so the deploy fails. The runtime supplies Python; list only added deps.
+name: sf_env
+channels:
+  - snowflake
+dependencies:
+  - streamlit=1.50.0
+  - pandas
+  - plotly
+  - snowflake-snowpark-python

streamsnow/_templates/app/example_metric.sql.j2

@@ -0,0 +1,12 @@
+-- Query: example_metric
+-- Feeds: Overview page (example metric + trend)
+-- Schemas: {{ gov_database }}.{{ schema_allow[0] }}
+-- Params: :1 start_date, :2 end_date
+SELECT
+    metric_date          AS dt,
+    COUNT(*)             AS n,
+    SUM(amount)          AS total
+FROM {{ gov_database }}.{{ schema_allow[0] }}.YOUR_TABLE  -- TODO: replace YOUR_TABLE
+WHERE metric_date BETWEEN :1 AND :2
+GROUP BY metric_date
+ORDER BY metric_date

streamsnow/_templates/app/overview.py.j2

@@ -0,0 +1,48 @@
+"""Overview page for {{ app_title }}. Scaffolded by StreamSnow ({{ runtime }} runtime).
+
+Replace the example metric with your real KPIs and repoint the query at a real
+table in an allowed schema ({{ schema_allow | join(', ') }}).
+"""
+
+import plotly.express as px
+import streamlit as st
+
+from branding import BRAND_CHART_COLORS, branded_metric
+from sql_loader import load_sql
+
+
+@st.cache_data(ttl={{ cache_ttl }})
+def load_example(start_date: str, end_date: str):
+    """Example cached loader. Wire to real filters once YOUR_TABLE is replaced."""
+    sql = load_sql("example_metric")
+{% if runtime == 'container' %}
+    conn = st.connection("snowflake")
+    return conn.query(sql, params=[start_date, end_date], ttl=0)
+{% else %}
+    try:
+        from snowflake.snowpark.context import get_active_session
+
+        session = get_active_session()
+    except Exception:
+        session = st.connection("snowflake").session()
+    return session.sql(sql, params=[start_date, end_date]).to_pandas()
+{% endif %}
+
+
+st.title("{{ app_title }}")
+st.caption("Starter page scaffolded by StreamSnow. Replace the example with your data.")
+
+st.subheader("Example metric")
+st.caption("Demonstrates branded_metric and a Plotly chart using your brand colors.")
+branded_metric("Rows", "1,234", delta="+5.3%")
+
+fig = px.bar(
+    x=["alpha", "beta", "gamma"],
+    y=[3, 1, 2],
+    labels={"x": "category", "y": "count"},
+    color_discrete_sequence=BRAND_CHART_COLORS,
+)
+st.plotly_chart(fig, use_container_width=True)
+
+st.divider()
+st.caption("Sources: {{ gov_database }}.{{ schema_allow[0] }} (example)")

streamsnow/_templates/app/pyproject.toml.j2

@@ -0,0 +1,12 @@
+# Container-runtime dependencies (PyPI via external access integration).
+# PEP 440 specifiers — NOT conda wildcards. Do not add a separate python pin here.
+[project]
+name = "{{ app_slug }}"
+version = "0.1.0"
+requires-python = ">={{ container_python }},<3.{{ container_python.split('.')[1] | int + 1 }}"
+dependencies = [
+    "streamlit==1.50.0",
+    "pandas>=2,<3",
+    "plotly>=5,<6",
+    "snowflake-snowpark-python",
+]

streamsnow/_templates/app/secrets.toml.example.j2

@@ -0,0 +1,10 @@
+# Local preview only. Copy to secrets.toml (gitignored) and fill in.
+# secrets.toml is NEVER committed.
+[connections.snowflake]
+account = "{{ account }}"
+user = "<your_username>"
+authenticator = "externalbrowser"
+role = "{{ viewer_role }}"
+warehouse = "{{ default_warehouse }}"
+database = "{{ gov_database }}"
+schema = "{{ schema_allow[0] }}"

streamsnow/_templates/app/snowflake.yml.j2

@@ -0,0 +1,29 @@
+definition_version: 2
+entities:
+  {{ app_slug | replace('-', '_') }}:
+    type: streamlit
+    identifier:
+      name: {{ app_slug | replace('-', '_') | upper }}
+      database: {{ app_database }}
+      schema: {{ app_schema }}
+    main_file: streamlit_app.py
+    query_warehouse: {{ default_warehouse }}
+    title: "{{ app_title }}"
+{% if runtime == 'container' %}
+    runtime_name: {{ runtime_name }}
+    compute_pool: {{ compute_pool }}
+    external_access_integrations:
+      - {{ external_access_integration }}
+{% endif %}
+    artifacts:
+      - streamlit_app.py
+      - pages/
+      - queries/
+      - branding.py
+      - sql_loader.py
+      - .streamlit/config.toml
+{% if runtime == 'container' %}
+      - pyproject.toml
+{% else %}
+      - environment.yml
+{% endif %}

streamsnow/_templates/app/sql_loader.py.j2

@@ -0,0 +1,21 @@
+"""Load SQL from ``queries/``. Each app ships its own copy.
+
+- ``load_sql(name)`` returns the raw file contents.
+- ``render_sql(name, **tokens)`` substitutes ``{UPPERCASE_TOKEN}`` placeholders
+  via str.replace (NOT str.format — SQL patterns like ``{2}`` would collide).
+"""
+
+from pathlib import Path
+
+_QUERIES = Path(__file__).parent / "queries"
+
+
+def load_sql(name: str) -> str:
+    return (_QUERIES / f"{name}.sql").read_text()
+
+
+def render_sql(name: str, **tokens: str) -> str:
+    sql = load_sql(name)
+    for key, value in tokens.items():
+        sql = sql.replace("{" + key + "}", value)
+    return sql

streamsnow/_templates/app/streamlit_app.py.j2

@@ -0,0 +1,16 @@
+"""{{ app_title }} — entrypoint. Scaffolded by StreamSnow ({{ runtime }} runtime)."""
+
+import streamlit as st
+
+st.set_page_config(page_title="{{ app_title }}", page_icon="📊", layout="wide")
+
+from branding import apply_branding  # noqa: E402  (must follow set_page_config)
+
+apply_branding()
+
+nav = st.navigation(
+    [
+        st.Page("pages/overview.py", title="Overview", icon="📈", default=True),
+    ]
+)
+nav.run()

streamsnow/_templates/repo/AGENTS.md.j2

@@ -0,0 +1,52 @@
+# {{ project_name }} — Streamlit-in-Snowflake apps
+
+Generated by [StreamSnow](https://github.com/kyle-chalmers/streamsnow). This file is the
+rulebook every Claude Code session and every developer follows. Config source of
+truth: `streamsnow.config.yaml`.
+
+## Data access rules
+
+- Query the `{{ gov_database }}` database. Allowed schemas (convention): {{ schema_allow | join(', ') }}.
+- **Never** reference these schemas in committed app code: {{ schema_deny | join(', ') }}. This denylist is **auto-enforced**.
+{% if read_exceptions %}
+- Sanctioned direct-read exceptions (named columns only): {{ read_exceptions | join(', ') }}.
+{% endif %}
+- Don't hardcode table names you haven't verified. Discover via `INFORMATION_SCHEMA` during investigation; reference concrete objects in committed SQL.
+
+The `check schema-refs` guardrail (pre-commit + the generated CI workflow) enforces the denylist from config — it blocks a commit/PR that references a denied schema. The allowlist above is a documented convention, not auto-enforced (avoids false positives on system schemas like `INFORMATION_SCHEMA`).
+
+## Runtime: {{ runtime }}
+
+{% if runtime == 'container' %}
+Container runtime (`{{ runtime_name }}`, Python {{ container_python }}). Dependencies in `pyproject.toml` (PyPI via the `{{ external_access_integration }}` external access integration). Connect with `st.connection("snowflake")` — works identically locally and deployed.
+{% else %}
+Warehouse runtime (legacy). Dependencies in `environment.yml` (Snowflake Anaconda channel — **never pin `python`**). Connect with `get_active_session()` wrapped in a try/except `st.connection` fallback for local dev.
+{% endif %}
+Query warehouse: `{{ default_warehouse }}`. Deployed apps run with caller's-rights as `{{ viewer_role }}`.
+
+## Caching
+
+Every data-fetching function MUST use `@st.cache_data(ttl=<seconds>)`. Default TTL is {{ cache_ttl }}s; deviate only with a documented reason. Pass filter values as function arguments (not closures) so the cache key differentiates.
+
+## SQL organization
+
+Any SQL that feeds a UI element lives in `apps/<slug>/queries/<name>.sql` (loaded via `sql_loader.py`), with a header block: `-- Query:`, `-- Feeds:`, `-- Schemas:`, `-- Params:`. Inline SQL is only for plumbing/discovery.
+
+## Deploy source: {{ deploy_source }}
+
+{% if deploy_source == 'stage-copy' %}
+CI pushes `apps/` to a SHA-versioned internal stage (`{{ stage_database }}.{{ stage_schema }}.{{ stage_name }}/commits/<sha>/apps/<slug>/`) and runs `CREATE OR REPLACE STREAMLIT` against that path. Snowflake never reaches out to GitHub.
+{% else %}
+Snowflake's `GIT REPOSITORY` pulls app source on `snow git fetch`; deploy runs `CREATE STREAMLIT ... FROM '@<repo>/branches/{{ "{" }}branch}/apps/<slug>/'` (new) or the `ABORT → PULL → COMMIT → ADD LIVE VERSION FROM LAST` refresh (existing). Requires Snowflake→GitHub network reachability.
+{% endif %}
+STREAMLIT objects are created in `{{ app_database }}.{{ app_schema }}`. Deploy through CI on merge to `main` — never `snow streamlit deploy` locally. (Wire the deploy workflow + your Snowflake CI credentials per the deploy docs; the generated CI workflow covers lint + schema-refs today.)
+
+## Number formatting
+
+Every number shown to a user includes thousand separators (`format="localized"`/`"dollar"`/`"percent"` for column configs; `f"{n:,}"` / `f"${v:,.2f}"` inline).
+
+## Conventions
+
+- App directories: `{domain}-{function}` kebab-case under `apps/`.
+- Entrypoint is `streamlit_app.py` (not configurable). `st.set_page_config(...)` first, once. Multipage via `st.navigation` + `st.Page`.
+- Import branding from the local copy: `from branding import ...`.

streamsnow/_templates/repo/CLAUDE.md.j2

@@ -0,0 +1 @@
+@AGENTS.md

streamsnow/_templates/repo/README.md.j2

@@ -0,0 +1,33 @@
+# {{ project_name }}
+
+Streamlit-in-Snowflake apps, scaffolded and governed with
+[StreamSnow](https://github.com/kyle-chalmers/streamsnow).
+
+- **Runtime:** {{ runtime }}
+- **Deploy source:** {{ deploy_source }}
+- **Data:** queries `{{ gov_database }}` (schemas: {{ schema_allow | join(', ') }})
+
+## Apps
+
+| App | Path |
+|-----|------|
+| {{ app_title }} | `apps/{{ app_slug }}/` |
+
+## Local development
+
+```bash
+uv venv --python 3.11
+uv pip install streamsnow
+cp apps/{{ app_slug }}/.streamlit/secrets.toml.example apps/{{ app_slug }}/.streamlit/secrets.toml
+# edit secrets.toml with your Snowflake connection, then:
+streamlit run apps/{{ app_slug }}/streamlit_app.py
+```
+
+## Add an app
+
+```bash
+streamsnow new <domain> <function>
+```
+
+Governance rules (data access, caching, SQL layout, deploy) live in [`AGENTS.md`](AGENTS.md).
+Configuration is in [`streamsnow.config.yaml`](streamsnow.config.yaml).

streamsnow/_templates/repo/ci.yml.j2

@@ -0,0 +1,35 @@
+# Governance checks for {{ project_name }} (generated by StreamSnow).
+# Runs the same guardrails as the local pre-commit hooks. The deploy workflow
+# is wired separately when you connect your Snowflake CI credentials.
+name: checks
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: checks-${{ '{{' }} github.ref {{ '}}' }}
+  cancel-in-progress: true
+
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - name: Install tooling
+        run: |
+          uv tool install ruff
+          uv tool install streamsnow
+      - name: Lint
+        run: ruff check apps/
+      - name: Governance gate (validate every app)
+        run: |
+          for d in apps/*/; do
+            [ -d "$d" ] || continue
+            streamsnow validate-app "$(basename "$d")"
+          done

streamsnow/_templates/repo/deploy.git.yml.j2

@@ -0,0 +1,66 @@
+{% raw %}# Deploy to Snowflake on merge to main (generated by StreamSnow — git-repository).
+# EXPERIMENTAL source: Snowflake must reach GitHub (snow git fetch) or you mint a
+# GitHub-App token into your secret. Run `streamsnow deploy-setup` once to create
+# the API integration + secret + GIT REPOSITORY. Same SNOWFLAKE_* repo secrets as
+# stage-copy; until SNOWFLAKE_ACCOUNT is set this job skips.
+name: deploy
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-snowflake
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    env:
+      SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
+      SNOWFLAKE_USER: ${{ secrets.SNOWFLAKE_USER }}
+      SNOWFLAKE_AUTHENTICATOR: SNOWFLAKE_JWT
+      SNOWFLAKE_PRIVATE_KEY_RAW: ${{ secrets.SNOWFLAKE_PRIVATE_KEY_RAW }}
+      SNOWFLAKE_PRIVATE_KEY_PASSPHRASE: ${{ secrets.SNOWFLAKE_PRIVATE_KEY_PASSPHRASE }}
+      SNOWFLAKE_WAREHOUSE: ${{ secrets.SNOWFLAKE_WAREHOUSE }}
+      SNOWFLAKE_ROLE: ${{ secrets.SNOWFLAKE_ROLE }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Gate on configured secrets
+        id: gate
+        run: |
+          if [ -z "$SNOWFLAKE_ACCOUNT" ]; then
+            echo "Deploy secrets not set — skipping (see docs/deploy-setup.md)."
+            echo "go=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "go=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: astral-sh/setup-uv@v5
+        if: steps.gate.outputs.go == 'true'
+
+      - name: Install tooling
+        if: steps.gate.outputs.go == 'true'
+        run: |
+          uv tool install streamsnow
+          uv tool install snowflake-cli-labs
+
+      - name: Deploy changed apps (git-repository)
+        if: steps.gate.outputs.go == 'true'
+        run: |
+          set -euo pipefail
+          REPO="$(streamsnow config-get deploy.git_repository_fqn)"
+          snow git fetch "$REPO"
+          for d in apps/*/; do
+            [ -d "$d" ] || continue
+            slug="$(basename "$d")"
+            streamsnow deploy-sql "$slug" > "/tmp/ss-$slug.sql"
+            snow sql -f "/tmp/ss-$slug.sql"
+            streamsnow deploy-sql "$slug" --refresh > "/tmp/ss-$slug-refresh.sql"
+            snow sql -f "/tmp/ss-$slug-refresh.sql" || true
+          done
+{% endraw %}

streamsnow/_templates/repo/deploy.yml.j2

@@ -0,0 +1,68 @@
+{% raw %}# Deploy to Snowflake on merge to main (generated by StreamSnow — stage-copy).
+# Set these repo secrets first (docs/deploy-setup.md). Until SNOWFLAKE_ACCOUNT is
+# set the job SKIPS, so it never red-X's a normal merge:
+#   SNOWFLAKE_ACCOUNT  SNOWFLAKE_USER  SNOWFLAKE_PRIVATE_KEY_RAW
+#   SNOWFLAKE_PRIVATE_KEY_PASSPHRASE (optional)  SNOWFLAKE_WAREHOUSE  SNOWFLAKE_ROLE
+name: deploy
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-snowflake
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    env:
+      SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
+      SNOWFLAKE_USER: ${{ secrets.SNOWFLAKE_USER }}
+      SNOWFLAKE_AUTHENTICATOR: SNOWFLAKE_JWT
+      SNOWFLAKE_PRIVATE_KEY_RAW: ${{ secrets.SNOWFLAKE_PRIVATE_KEY_RAW }}
+      SNOWFLAKE_PRIVATE_KEY_PASSPHRASE: ${{ secrets.SNOWFLAKE_PRIVATE_KEY_PASSPHRASE }}
+      SNOWFLAKE_WAREHOUSE: ${{ secrets.SNOWFLAKE_WAREHOUSE }}
+      SNOWFLAKE_ROLE: ${{ secrets.SNOWFLAKE_ROLE }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Gate on configured secrets
+        id: gate
+        run: |
+          if [ -z "$SNOWFLAKE_ACCOUNT" ]; then
+            echo "Deploy secrets not set — skipping (see docs/deploy-setup.md)."
+            echo "go=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "go=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: astral-sh/setup-uv@v5
+        if: steps.gate.outputs.go == 'true'
+
+      - name: Install tooling
+        if: steps.gate.outputs.go == 'true'
+        run: |
+          uv tool install streamsnow
+          uv tool install snowflake-cli-labs
+
+      - name: Deploy changed apps (stage-copy)
+        if: steps.gate.outputs.go == 'true'
+        run: |
+          set -euo pipefail
+          STAGE="$(streamsnow stage-path)"
+          streamsnow deploy-setup > /tmp/ss-setup.sql && snow sql -f /tmp/ss-setup.sql
+          snow stage copy "apps/" "$STAGE/commits/$GITHUB_SHA/apps/" --recursive --overwrite
+          for d in apps/*/; do
+            cfg="${d}.streamlit/config.toml"
+            [ -f "$cfg" ] && snow stage copy "$cfg" "$STAGE/commits/$GITHUB_SHA/apps/$(basename "$d")/.streamlit/" --overwrite
+          done
+          for d in apps/*/; do
+            slug="$(basename "$d")"
+            streamsnow deploy-sql "$slug" --sha "$GITHUB_SHA" > "/tmp/ss-$slug.sql"
+            snow sql -f "/tmp/ss-$slug.sql"
+          done
+{% endraw %}

streamsnow/_templates/repo/gitignore.j2

@@ -0,0 +1,21 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+venv/
+
+# Tooling
+.ruff_cache/
+.pytest_cache/
+
+# Secrets — NEVER commit
+**/.streamlit/secrets.toml
+
+# Review/walkthrough artifacts (screenshots, reports)
+apps/*/.review/
+
+# OS / editor
+.DS_Store
+.idea/
+.vscode/

streamsnow/_templates/repo/pre-commit-config.yaml.j2

@@ -0,0 +1,42 @@
+# Pre-commit hooks for {{ project_name }}. Install with: pre-commit install
+# Requires: pip/uv install streamsnow (provides the `streamsnow` CLI).
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.9
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: v1.5.0
+    hooks:
+      - id: detect-secrets
+
+  - repo: local
+    hooks:
+      # All four require the `streamsnow` package on PATH (uv/pip install streamsnow).
+      - id: streamsnow-schema-refs
+        name: streamsnow check schema-refs (block denied schemas)
+        entry: streamsnow check schema-refs
+        language: system
+        files: ^apps/.*\.(py|sql)$
+        pass_filenames: true
+      - id: streamsnow-security
+        name: streamsnow check security (no egress/exec/write-SQL)
+        entry: streamsnow check security
+        language: system
+        files: ^apps/.*\.(py|sql)$
+        pass_filenames: true
+      - id: streamsnow-bind-predicates
+        name: streamsnow check bind-predicates (Go-driver trap)
+        entry: streamsnow check bind-predicates
+        language: system
+        files: ^apps/.*\.(py|sql)$
+        pass_filenames: true
+      - id: streamsnow-caching
+        name: streamsnow check caching (@st.cache_data ttl required)
+        entry: streamsnow check caching
+        language: system
+        files: ^apps/.*\.py$
+        pass_filenames: true