vericto 0.2.0__tar.gz

vericto-0.2.0/.gitignore

@@ -0,0 +1,12 @@
+__pycache__/
+*.py[cod]
+.venv/
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+.coverage
+htmlcov/
+build/
+dist/
+*.egg-info/
+.DS_Store

vericto-0.2.0/CHANGELOG.md

@@ -0,0 +1,93 @@
+# Changelog
+
+All notable changes to this package are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
+[Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.2.0] - 2026-10-16
+
+Integrations for LangChain, LlamaIndex, dbt and Airflow, each a thin layer over
+the guard. Nothing changes for 0.1.0 code.
+
+### Added
+
+- `vericto[langchain]`: `vericto.langchain.VerictoSQLDatabase`, a
+  `langchain_community` `SQLDatabase` whose queries (and table-info sample rows)
+  are checked; a blocked query returns an explanation with the rule and the
+  suggested fix to the agent (`on_block="return"`, default) or raises
+  (`on_block="raise"`). Masked queries run rewritten. Plus
+  `VerictoCheckSQLTool`, a check-only tool.
+- `vericto[llamaindex]`: `vericto.llamaindex.VerictoSQLDatabase` for
+  `NLSQLTableQueryEngine` / `SQLTableRetrieverQueryEngine`, same behaviour.
+- `vericto[dbt]`: the `vericto-dbt check` command (also
+  `python -m vericto dbt check`). It reads `target/manifest.json` after
+  `dbt compile`, checks compiled models, snapshots and hooks with the CI-check
+  API (`POST /api/v1/ci/check-key`, monthly CI-check allowance), maps the
+  adapter to the dialect, prints a table or writes JSON / SARIF, and exits as
+  vericto-cli does (`--fail-on blocked|flagged|any`). It honours the workspace's
+  `sanitized` telemetry mode with a port of vericto-cli's literal sanitizer.
+- `vericto[airflow]`: `vericto.airflow.VerictoSQLExecuteQueryOperator` and the
+  cluster policy `vericto.airflow.policy.guard_sql_tasks`. Both check the rendered
+  SQL, statement by statement, before any of it runs. A block fails the task
+  without retries (`VerictoTaskBlocked`). The dialect comes from the connection
+  type or from `vericto_dialect` in the connection extra. Tested on Airflow 3.3.2
+  and 2.11.2.
+- `vericto.sqlalchemy.is_instrumented(engine)`.
+- `vericto.ci_api.CiCheckClient`, a client for the CI-check API.
+
+- `tests/live/test_sqlite_live.py`: an opt-in end-to-end test of
+  `vericto.sqlite` against a real Runtime API (allowed statements, UPSERT, the
+  SQLite rules VERICTO-098/099/100/101, DELETE without WHERE, scripts with a
+  blocked statement). Skipped unless `VERICTO_LIVE_SQLITE=1` and the
+  `VERICTO_*` variables are set; see "Live tests" in the README.
+
+### Changed
+
+- `copy.deepcopy` of a `Vericto` guard returns the same guard, so frameworks
+  that deep-copy the objects holding it (Airflow operators) keep working.
+
+- Documentation: the Vericto server now evaluates the `sqlite` dialect
+  (vericto-engine 4.1.0; `GET /api/v1/meta/config` lists it), so
+  `vericto.sqlite` and SQLAlchemy/LangChain/LlamaIndex/Airflow on SQLite work
+  against it. The 0.1.0 known limitation no longer applies to such servers.
+  Unchanged behaviour: the wrappers still ask `/meta/config` and raise
+  `VerictoUnsupportedDialect`, before any SQL runs, against a server that does
+  not list `sqlite`.
+
+## [0.1.0] - never published
+
+First release: Vericto checks in front of Python database drivers, evaluated by
+the Vericto Runtime API (`POST /api/v1/proxy/query`).
+
+### Added
+
+- `Vericto` guard: raises `VerictoBlocked` on BLOCKED, runs the masked
+  `rewritten_query` for sensitive columns, logs FLAGGED / MONITORED / allowed
+  PARSE_ERROR verdicts and passes every verdict to `on_verdict`.
+- Fail mode per guard: `closed` (default) raises `VerictoUnavailable` when
+  Vericto cannot answer; `open` runs the statement and emits
+  `VerictoFailOpenWarning`. Configuration errors are never failed open.
+- `RuntimeApiEvaluator`: `VERICTO_*` environment configuration as in vericto-cli,
+  HTTPS-only key handling, timeouts, retries with backoff on 5xx / 429 rate
+  limits, `VerictoQuotaExceeded` for the monthly quota, and dialect discovery
+  through `GET /api/v1/meta/config`.
+- `Evaluator` protocol, so an embedded evaluator can be added later.
+- Wrappers: `vericto.snowflake` (`execute`, `executemany`, `execute_async`,
+  `execute_string`, `execute_stream`), `vericto.sqlite` (a `sqlite3.Connection`
+  subclass; `execute`, `executemany`, `executescript`), `vericto.sqlalchemy`
+  (`before_cursor_execute` for any dialect) and the generic `vericto.wrap` for
+  DB-API drivers.
+- Scripts are evaluated statement by statement before the first one runs.
+- `%s` / `%(name)s` placeholders are evaluated as the dialect's own placeholders;
+  parameter values are never sent.
+- Optional verdict cache (off by default).
+
+### Known limitations
+
+- The Vericto engine does not evaluate the `sqlite` dialect yet: the SQLite
+  wrappers raise `VerictoUnsupportedDialect` until the server lists it.
+
+[0.2.0]: https://github.com/vericto/vericto-python/releases/tag/v0.2.0
+[0.1.0]: https://github.com/vericto/vericto-python/releases/tag/v0.1.0

vericto-0.2.0/LICENSE

@@ -0,0 +1,93 @@
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject to
+the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor's trademarks is subject
+to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you
+also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.
+
+## Definitions
+
+The "licensor" is the entity offering these terms, and the "software" is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+"you" refers to the individual or entity agreeing to these terms.
+
+"your company" is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that organization.
+"control" means ownership of substantially all the assets of an entity, or the
+power to direct its management and policies by vote, contract, or otherwise.
+Control can be direct or indirect.
+
+"your licenses" are all the licenses granted to you for the software under these
+terms.
+
+"use" means anything you do with the software requiring one of your licenses.
+
+"trademark" means trademarks, service marks, and similar rights.