feat(snowflake): add pure-Python Snowflake SQL API adapter

AGENTS.md

@@ -49,6 +49,7 @@ The package uses optional extras to minimize Lambda bundle size:
 - `database` - MySQL/PostgreSQL drivers
 - `slack` - Slack SDK
 - `jwt` - RS256 JWT validation (`rsa` package)
+- `snowflake` - Pure-Python Snowflake SQL API client (`snowflake-sql-api`)
 - `all` - All integrations
 - `dev` - Development and testing tools
 

README.md

@@ -65,12 +65,13 @@ Production-ready shared Python utilities for AWS Lambda functions, CLI tools, an
 pip install nui-python-shared-utils
 
 # With specific extras for optional dependencies
-pip install nui-python-shared-utils[all]          # All integrations
+pip install nui-python-shared-utils[all]          # Core optional integrations (excludes Snowflake)
 pip install nui-python-shared-utils[powertools]   # AWS Powertools only
 pip install nui-python-shared-utils[slack]        # Slack only
 pip install nui-python-shared-utils[elasticsearch] # Elasticsearch only
 pip install nui-python-shared-utils[database]     # Database only
 pip install nui-python-shared-utils[jwt]          # JWT authentication only
+pip install nui-python-shared-utils[snowflake]    # Snowflake SQL API client
 ```
 
 ### Basic Configuration
@@ -198,6 +199,31 @@ async with db.get_connection() as conn:
 
 **[→ See full database guide](docs/getting-started/quickstart.md#database-connections)**
 
+### Snowflake (SQL API)
+
+Pure-Python Snowflake client (no `snowflake-connector-python`), keypair auth via
+Secrets Manager, with NUI session defaults (`TIMEZONE=Pacific/Auckland`, role
+`NUI_LAMBDA`) that you can override via `timezone=` and `role=`, plus a redacting
+query-logging hook.
+
+```python
+from nui_shared_utils import create_snowflake_client
+
+# Loads account/user/private_key from Secrets Manager ("snowflake-credentials"
+# by default; override with SNOWFLAKE_CREDENTIALS_SECRET or secret_name=).
+# The NUI defaults are overridable, so the client stays generic for any account.
+client = create_snowflake_client(
+    warehouse="COMPUTE_WH",
+    database="ANALYTICS",
+    timezone="UTC",          # override the Pacific/Auckland default
+    role="MY_APP_ROLE",      # override the NUI_LAMBDA default
+)
+rows = client.query("SELECT id, name FROM orders WHERE status = ?", ["confirmed"])
+```
+
+Sync is the default; use `create_async_snowflake_client(...)` inside a Lambda
+already on an event loop. Requires the `[snowflake]` extra.
+
 ### CloudWatch Metrics
 
 ```python

nui_lambda_shared_utils/snowflake_client.py

@@ -0,0 +1,3 @@
+"""Backwards-compatibility shim. Use nui_shared_utils.snowflake_client instead."""
+
+from nui_shared_utils.snowflake_client import *  # noqa: F401,F403

nui_shared_utils/__init__.py

@@ -104,6 +104,11 @@
     # Optional: AWS Powertools
     "get_powertools_logger": ("powertools_helpers", "get_powertools_logger"),
     "powertools_handler": ("powertools_helpers", "powertools_handler"),
+    # Optional: Snowflake client adapter (snowflake-sql-api)
+    "create_snowflake_client": ("snowflake_client", "create_snowflake_client"),
+    "create_async_snowflake_client": ("snowflake_client", "create_async_snowflake_client"),
+    "get_snowflake_credentials": ("snowflake_client", "get_snowflake_credentials"),
+    "redacting_query_logger": ("snowflake_client", "redacting_query_logger"),
     # Optional: JWT validation (rsa)
     "validate_jwt": ("jwt_auth", "validate_jwt"),
     "require_auth": ("jwt_auth", "require_auth"),
@@ -124,6 +129,7 @@
     "db_client",
     "powertools_helpers",
     "jwt_auth",
+    "snowflake_client",
     "slack_setup",
 }
 
@@ -248,6 +254,12 @@ def __dir__() -> List[str]:
         build_user_activity_query,
     )
     from .db_client import DatabaseClient, PostgreSQLClient, get_pool_stats
+    from .snowflake_client import (
+        create_async_snowflake_client,
+        create_snowflake_client,
+        get_snowflake_credentials,
+        redacting_query_logger,
+    )
     from .powertools_helpers import get_powertools_logger, powertools_handler
     from .jwt_auth import (
         AuthenticationError,