cqr-fundflows 0.3.1

Compiled Bloomberg BQuant fund-flow analytics dashboard

CQR Fund Flows

Compiled Bloomberg BQuant dashboard for fund-flow analysis.

Offline access control

The package authorises the current Bloomberg user locally. On launch, the compiled extension normalises Bloomberg's UUID, calculates its HMAC-SHA256 fingerprint, and compares it with the allowlist embedded in the wheel. Access data has an expiry date, so users must install a current release.

This check makes no authentication request over the network and requires no licence token. Bloomberg data requests made by the dashboard itself still use BQuant's preinstalled bql module.

Supported environment

• Bloomberg BQuant
• Windows 64-bit
• CPython 3.11
• Bloomberg's bql module already available in the environment

Installation

python -m pip install cqr-fundflows

Usage

Run in a BQuant notebook:

from cqr_fundflows import launch_dashboard

launch_dashboard()

Only launch_dashboard() is part of the supported public API.

Access control

There is no licence key to paste into the notebook. At import time, the compiled extension reads Bloomberg BQuant's protected UUID environment variable and asks the CQR HTTPS authorization endpoint whether that Bloomberg USER ID has an active Fund Flows entitlement.

Access is granted only when all of the following are true:

• the client account exists;
• its professional email address has been verified;
• CQR has manually marked the Fund Flows entitlement as active;
• the entitlement has started and has not expired.

The check fails closed when the UUID is missing or when the authorization service cannot be reached. No client password, private API credential or service-role key is included in the Python package.

See ACCESS_CONTROL.md for the one-time Supabase and website deployment.

Distribution model

PyPI releases contain compiled wheels. Do not publish a source distribution (.tar.gz), because it would disclose the Cython source and the generated access include. Keep the source repository private.

The wheel must not contain _dashboard.pyx, generated C/C++ source, a Python fallback for the dashboard, or _access_data.pxi. The access data is compiled into the native extension instead.

Local Windows build

py -3.11 -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install --upgrade pip build twine cryptography
python scripts\build_offline_access.py --verify-only
python -m unittest discover -s tests -v
python -m build --wheel
python -m twine check .\dist\*
$wheel = Get-ChildItem .\dist\*.whl | Select-Object -First 1
python scripts\verify_wheel_contents.py $wheel.FullName

The expected output is similar to:

cqr_fundflows-0.3.0-cp311-cp311-win_amd64.whl

Maintainers should follow ACCESS_CONTROL.md before every release and PUBLISHING.md for the complete publication flow.

Limitation

Cython compilation and fingerprinting make casual sharing more difficult, but they are not absolute protection against reverse engineering, environment spoofing, or continued use of a previously downloaded wheel before it expires.